Remediation made simple: Introducing new validity checks for GitHub tokens
GitHub now tells you whether GitHub tokens found by secret scanning are active so you can prioritize and escalate remediation efforts.
If you’re on an application security team, you might use secret scanning to reduce the risk of leaked credentials, like passwords and API keys. When an exposed credential is found, your first step is probably to check whether the token is still active, and what access it has. Now, with validity checks for GitHub tokens, we can help you do just that.
Validity checks determine whether a token is still active and, when possible, whether it was ever active. This is useful when you’re deciding how to remediate an exposure. For example, you might prioritize remediating active secrets before checking your security logs for unauthorized access via API keys that have already been revoked.
To check a GitHub token’s validity, open a secret scanning alert for the leaked GitHub token and the alert will tell you whether the secret is still active. If we can’t accurately detect the validity—this can happen when a token found on GitHub.com belongs to a GitHub Enterprise Server instance—we’ll provide insight on where to look for remediation.
Coming soon: We’ll validate secrets that belong to our 100 secret scanning partners too. Learn more about how you can secure your repositories with secret scanning.
Tags:
Written by
Related posts
The second half of software supply chain security on GitHub
Learn about a community-developed framework for how to think about this problem holistically and how to use GitHub, particularly, to improve the security in the second half of your software supply chain.
Cybersecurity spotlight on bug bounty researcher @imrerad
For this year’s Cybersecurity Awareness Month, the GitHub Bug Bounty team is excited to feature another spotlight on a talented security researcher who participates in the GitHub Security Bug Bounty Program—@imrerad!
Kicking off Cybersecurity Awareness Month: Researcher spotlights and additional incentives!
For this year’s Cybersecurity Awareness Month, GitHub’s Bug Bounty team is excited to offer some additional incentives to security researchers!