Introducing extended metadata checks for secret scanning

[ghostinhershell]

To help you understand ownership and impact of a leaked secret, GitHub secret scanning now surfaces additional metadata for supported secret types.

What's changing?

Secret scanning already performs validity checks for most secret providers, verifying whether a detected secret is active. This update extends those checks to include additional metadata fields from supported providers.

Available in public preview for supported secret types, alerts now display details about a secret's owner, secret creation and expiry dates, and project or organization context when information is available from the secret provider. For example, leaked OpenAI keys will display the secret owner's name, email, and identifier, in addition to information about the organization when available. These new metadata keys expand on existing validity checks to give more actionable context for triage and remediation, enabling development and security teams to assess exposure faster and prioritize remediation.

Please note, metadata availability will vary by secret provider, token type, and possibly even for a specific secret at different points in time. GitHub makes a best effort to display metadata for the secret, but not all metadata keys may be available for a secret.

What secret types are supported?

GitHub will continually add support for additional secret types on a rolling basis. In addition to previously announced support for active GitHub tokens, metadata checks are now supported for the following types:

Provider	Token	Extended Metadata
Adafruit	ADAFRUIT_AIO_KEY	✅
Anthropic	ANTHROPIC_API_KEY	✅
Apify	APIFY_API_TOKEN	✅
Contentful	CONTENTFUL_PERSONAL_ACCESS_TOKEN	✅
Discord	DISCORD_API_TOKEN	✅
Discord	DISCORD_API_TOKEN_V2	✅
Dropbox	DROPBOX_OAUTH2_ACCESS_TOKEN	✅
Dropbox	DROPBOX_OAUTH2_SHORT_LIVED_ACCESS_TOKEN	✅
Fastly	FASTLY_API_TOKEN	✅
Figma	FIGMA_PAT	✅
GitLab	GITLAB_ACCESS_TOKEN	✅
Google	GOOGLE_OAUTH_ACCESS_TOKEN	✅
Hugging Face	HUGGING_FACE_USER_ACCESS_TOKEN	✅
Intercom	INTERCOM_ACCESS_TOKEN	✅
Mailchimp	MAILCHIMP_API	✅
Mailgun	MAILGUN	✅
Mailgun	MAILGUN_LEGACY	✅
Mapbox	MAPBOX_SECRET_ACCESS_TOKEN	✅
Notion	NOTION_INTEGRATION_TOKEN	✅
OpenAI	OPENAI_API_KEY	✅
OpenAI	OPENAI_API_KEY_V2	✅
Postman	POSTMAN_API_KEY_V2	✅
SendGrid	SENDGRID_API_KEY	✅
Slack	SLACK	✅
Slack	SLACK_OPAQUE	✅
Stripe	STRIPE_LIVE_API_SECRET_KEY	✅
Stripe	STRIPE_TEST_API_SECRET_KEY	✅
Tailscale	TAILSCALE_API_KEY	✅
Telegram	TELEGRAM_BOT_TOKEN	✅
Terraform Cloud	TERRAFORM_CLOUD_ENTERPRISE_TOKEN	✅

See the full list of supported secrets or keep an eye on the GitHub changelog for updates.

When is the analysis run for a given secret?

GitHub will run extended metadata checks for secret scanning alerts when a secret is both confirmed active and in the list of supported secret types. In addition, an admin or security manager first needs to enable extended metadata checks for a given repository.

Where is metadata displayed?

Extended metadata is shown in the right-hand side of an alert, along with additional information about the alert, like alert assignees or associated security campaigns.

Who can use this feature?

Extended metadata checks are available in public preview for GitHub Secret Protection and GitHub Advanced Security customers on github.com, including GitHub Enterprise Cloud with data residency.

Get started with metadata checks

The feature can be enabled from the repository settings page. Validity checks must be enabled in order to enable the extended checks. Once enabled, additional information will be displayed in the alert details view for active secrets when available.

Learn more and share feedback

Learn more about securing your repositories with secret scanning and join the discussion by leaving feedback in the comments below!