{"meta":{"title":"About secret scanning alerts","intro":"Learn about the different types of secret scanning alerts.","product":"Security and code quality","breadcrumbs":[{"href":"/en/code-security","title":"Security and code quality"},{"href":"/en/code-security/concepts","title":"Concepts"},{"href":"/en/code-security/concepts/secret-security","title":"Secret security"},{"href":"/en/code-security/concepts/secret-security/about-alerts","title":"Secret scanning alerts"}],"documentType":"article"},"body":"# About secret scanning alerts\n\nLearn about the different types of secret scanning alerts.\n\n## About types of alerts\n\nThere are three types of secret scanning alerts:\n\n* **User alerts:** Reported to users in the ** Security and quality** tab of the repository, when a supported secret is detected in the repository.\n* **Push protection alerts:** Reported to users in the ** Security and quality** tab of the repository, when a contributor bypasses push protection.\n* **Partner alerts:** Reported directly to secret providers that are part of secret scanning's partner program. These alerts are not reported in the ** Security and quality** tab of the repository.\n\n## About user alerts\n\nWhen you enable secret scanning for a repository or push commits to a repository with secret scanning enabled, GitHub scans the contents for secrets that match patterns defined by service providers.\n\nWhen secret scanning detects a secret, GitHub generates an alert. GitHub displays an alert in the ** Security and quality** tab of the repository. If the same secret appears multiple times within a single file, only one alert is created.\n\nTo help you triage alerts more effectively, GitHub separates alerts into two lists:\n\n* **Default** alerts\n* **Generic** alerts\n\n### Default alerts list\n\nThe default alerts list displays alerts that relate to supported patterns and specified custom patterns. This is the main view for alerts.\n\n### Generic alerts list\n\nThe generic alerts list displays alerts that relate to non-provider patterns (such as private keys), or generic secrets detected using AI (such as passwords). These types of alerts can have a higher rate of false positives or secrets used in tests. You can toggle to the generic alerts list from the default alerts list.\n\nGitHub will continue to release new patterns and secret types to the generic alerts list and will promote them to the default list when feature-complete (that is, when they have an appropriately low volume and false positive rate).\n\nIn addition, alerts that fall into this category:\n\n* Are limited in quantity to 5000 alerts per repository (this includes open and closed alerts).\n* Are not shown in the summary views for security overview, only in the \"Secret scanning\" view.\n* Only have the first five detected locations shown on GitHub for non-provider patterns, and only the first detected location shown for AI-detected generic secrets.\n\nFor GitHub to scan for non-provider patterns and generic secrets, you must first enable the features for your repository or organization. For more information, see [Enabling secret scanning for non-provider patterns](/en/code-security/how-tos/secure-your-secrets/detect-secret-leaks/enabling-secret-scanning-for-non-provider-patterns) and [Enabling Copilot secret scanning's generic secret detection](/en/code-security/secret-scanning/copilot-secret-scanning/enabling-ai-powered-generic-secret-detection).\n\nIf access to a resource requires paired credentials, then secret scanning will create an alert only when both parts of the pair are detected in the same file. This ensures that the most critical leaks are not hidden behind information about partial leaks. Pair matching also helps reduce false positives since both elements of a pair must be used together to access the provider's resource.\n\n## About push protection alerts\n\nPush protection scans pushes for supported secrets. If push protection detects a supported secret, it will block the push. When a contributor bypasses push protection to push a secret to the repository, a push protection alert is generated and displayed in the ** Security and quality** tab of the repository. To see all push protection alerts for a repository, you must filter by `bypassed: true` on the alerts page. For more information, see [Viewing and filtering alerts from secret scanning](/en/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/viewing-alerts#filtering-alerts).\n\nIf access to a resource requires paired credentials, then secret scanning will create an alert only when both parts of the pair are detected in the same file. This ensures that the most critical leaks are not hidden behind information about partial leaks. Pair matching also helps reduce false positives since both elements of a pair must be used together to access the provider's resource.\n\n> \\[!NOTE]\n> You can also enable push protection for your personal account, called \"push protection for users\", which prevents you from accidentally pushing supported secrets to *any* public repository. Alerts are *not* created if you choose to bypass your user-based push protection only. Alerts are only created if the repository itself has push protection enabled. For more information, see [Managing push protection for users](/en/code-security/secret-scanning/working-with-secret-scanning-and-push-protection/push-protection-for-users).\n>\n> Older versions of certain tokens may not be supported by push protection as these tokens may generate a higher number of false positives than their most recent version. Push protection may also not apply to legacy tokens. For tokens such as Azure Storage Keys, GitHub only supports *recently created* tokens, not tokens that match the legacy patterns. For more information about push protection limitations, see [Secret scanning detection scope](/en/code-security/how-tos/secure-your-secrets/troubleshooting-secret-scanning#push-protection-and-pattern-versions).\n\n## About partner alerts\n\nWhen GitHub detects a leaked secret in a public repository or npm package, an alert is sent directly to the secret provider, if they are part of GitHub's secret scanning partner program. For more information about secret scanning alerts for partners, see [Secret scanning partner program](/en/code-security/secret-scanning/secret-scanning-partnership-program/secret-scanning-partner-program) and [Supported secret scanning patterns](/en/code-security/reference/secret-security/supported-secret-scanning-patterns).\n\nPartner alerts are not sent to repository administrators, so you do not need to take any action for this type of alert.\n\n## Further reading\n\n* [Supported secret scanning patterns](/en/code-security/reference/secret-security/supported-secret-scanning-patterns)\n* [Enabling secret scanning for non-provider patterns](/en/code-security/how-tos/secure-your-secrets/detect-secret-leaks/enabling-secret-scanning-for-non-provider-patterns)"}