GitHub has enhanced its secret scanning feature, expanding its validation checks to include well-known services like Amazon Web Services (AWS), Microsoft, Google, and Slack.
These validation checks, introduced by the Microsoft subsidiary earlier this year, serve as a helpful alert system, indicating whether exposed tokens flagged by secret scanning are still active. This capability was initially rolled out for GitHub tokens.
The cloud-based code hosting and version control platform will broaden support for additional tokens.
How does it work?
To activate this feature, owners of enterprises or organizations, as well as repository administrators, can
- Navigate to the Settings section,
- Proceed to Code security and analysis,
- Finally, Secret scanning.
From there, they can select “Automatically verify if a secret is valid by sending it to the relevant partner.”
Earlier this year, GitHub also extended its secret scanning alerts to encompass all public repositories. Additionally, it introduced push protection, designed to help developers and maintainers proactively safeguard their code by scanning for easily identifiable secrets before they are pushed.
“As of today, GitHub secret scanning’s alert experience is generally available and free for all public repositories. You can enable secret scanning alerts across all your repositories to notify you of leaked secrets across your entire repository history, including code, issues, description, and comments.”
Are we doing enough to protect our digital domains?
Validation checks now extend to significant services such as AWS, Microsoft, Google, and Slack, GitHub empowers you to stay one step.
The concept of validating exposed tokens adds a layer of efficiency to the remediation process, giving organizations a real-time understanding of the status of their secrets.
This not only streamlines security efforts but also underscores the importance of proactive risk management in the world of code hosting and version control.
As GitHub continues to broaden its support for additional tokens, the trajectory is clear – a future where organizations can proactively safeguard their digital assets against evolving threats.
Are we doing enough to protect our digital domains? Our tools and commitment to proactive security and continuous improvement are the answer.
PureVPN
October 9, 2023
2 years ago
