We are excited to bring Transform 2022 back in-person July 19 and virtually July 20 - 28. Join AI and data leaders for insightful talks and exciting networking opportunities. Register today!
GitHub has announced that its enterprise-focused secret scanning tool for private repositories is now generally available.
The Microsoft-owned code-hosting platform first debuted secret scanning for private repositories last May as part of its advanced security program. This was introduced in beta alongside a new native code-scanning tool that automatically scans every git push for vulnerabilities. Code scanner launched in general availability in September and is followed today by secret scanning.
In related news, GitHub also announced the beta launch of a new “security overview” tool that gives security teams a single interface to view all the risks detected by GitHub’s advanced security tools. These span code scanning, secret scanning, and Dependabot. The overview highlights known and unknown security risks, where teams haven’t fully configured their security features.
“Secrets” refers to authentication credentials such as API tokens, passwords, and keys that protect access to applications, services, and other sensitive areas of a company’s digital infrastructure. GitHub first launched secret scanning — then known as “token scanning” — for public repositories back in 2018. It’s designed to help companies identify sensitive data hidden inside their public code before it’s found by bad actors.
There has been a flurry of activity in the secrets management space of late, with GitGuardian raising $12 million in funding a few months back to help companies detect sensitive data hidden in their code repositories and Doppler raising $6.5 million in a round of funding led by Alphabet’s GV to expand into the enterprise.
Recent data from GitGuardian indicates a 20% rise in secrets hidden in public GitHub repositories last year, a trend driven in part by a broader push toward code collaboration platforms as developers and businesses rapidly embraced remote work.
Businesses that use GitHub for private (i.e. non-open source) projects can buy a GitHub advanced security license as part of their Enterprise Cloud (hosted) or Enterprise Server (self-hosted) subscription, which gives them access to secrets scanning. In the 10 months since it first arrived in beta, GitHub said it has helped organizations find and revoke more than 5,000 secrets.
Since its beta launch last year, GitHub has added a bunch of new features, though some are currently only available for the GitHub Enterprise Cloud edition. These include an API and support for webhooks to set up secret scanning alerts, while GitHub has also expanded its secret scanning pattern coverage to incorporate tokens from more than 35 companies, including Shopify, Stripe, AWS, Azure, SendGrid, Twilio, and Slack.
Earlier today, GitHub also launched new granular controls for the GitHub mobile app, designed to boost developers’ productivity by helping them manage notifications and pause them at the end of a shift.
VentureBeat's mission is to be a digital town square for technical decision-makers to gain knowledge about transformative enterprise technology and transact. Learn more about membership.