This update expands secret scanning’s detection coverage:

  • New partner: SpaceX is now a secret scanning partner.
  • New detector: GitHub now detects starlink_public_api_v2_secret.
  • Upgraded detectors: Alibaba, AWS, Google, OpenVSX, Pydantic Services, and Tencent detectors include additional false-positive filtering.

New secret scanning partners

The following provider joined the secret scanning partnership program. When one of their secrets is found in a public repository, GitHub forwards it to the partner so they can revoke or rotate the credential before it can be abused.

Provider Secret type
SpaceX starlink_public_api_v2_secret

Detectors added

Secret scanning now automatically detects the following new secret type in your repositories.

Provider Secret type
SpaceX starlink_public_api_v2_secret

Partner secrets are automatically reported to the secret issuer when found in public repositories through the secret scanning partnership program. User secrets generate secret scanning alerts when found in public or private repositories.

False positives reduced

The following detector improvements reduce false-positive matches for supported secrets.

Provider Secret type Improvement
Alibaba alibaba_cloud_access_key_id Suppress unpaired matches when dictionary filtering removes all qualifying companion secrets.
AWS aws_access_key_id Suppress unpaired matches when dictionary filtering removes all qualifying companion secrets.
AWS aws_session_token Suppress unpaired matches when dictionary filtering removes all qualifying companion secrets.
AWS aws_temporary_access_key_id Suppress unpaired matches when dictionary filtering removes all qualifying companion secrets.
Google google_cloud_storage_access_key_secret Suppress unpaired matches when dictionary filtering removes all qualifying companion key identifiers.
Google google_cloud_storage_service_account_access_key_id Suppress unpaired matches when dictionary filtering removes all qualifying companion secrets.
Google google_cloud_storage_user_access_key_id Suppress unpaired matches when dictionary filtering removes all qualifying companion secrets.
OpenVSX openvsx_access_token Tighten context matching for legacy tokens to avoid treating unrelated UUIDs as credentials.
Pydantic Services Inc. logfire_token Match the documented token length and character set to exclude placeholder values and public browser tokens.
Tencent tencent_cloud_secret_id Require both letters and digits after the token prefix to exclude alphabetic identifiers such as function names.

Learn more

Learn more about secret scanning and see the full list of supported secrets in our documentation. Let us know what you think in the community discussion.