What Is GitHub Secret Scanning?

GitHub secret scanning automatically detects credentials, API keys, tokens, and other secrets that get accidentally committed to a repository. When a match is found, GitHub alerts the repository administrator and — with push protection enabled — blocks the commit before it reaches the remote.

For SOC 2 purposes, secret scanning is a direct control for CC6.1 (Logical and Physical Access Controls) and CC8.1 (Change Management). Auditors expect you to demonstrate that credentials cannot enter your codebase undetected.

How to Enable Secret Scanning in GitHub

Secret scanning is available on all GitHub Advanced Security plans and free for public repositories.

Step 1: Enable at the repository level

Go to your repository → Settings → Code security and analysis

Under GitHub Advanced Security, click Enable

Under Secret scanning, click Enable

Optionally enable Push protection — this blocks pushes containing detected secrets rather than only alerting after the fact

Step 2: Enable at the organization level (recommended)

For consistent SOC 2 coverage across all repositories, enable secret scanning organization-wide:

Go to your Organization Settings → Code security and analysis

Enable GitHub Advanced Security for all repositories

Enable Secret scanning for all repositories

Enable Push protection for all repositories

Step 3: Verify using the GitHub API

# Check secret scanning status for a repository
curl -H "Authorization: Bearer ${GITHUB_TOKEN}" \
  -H "Accept: application/vnd.github+json" \
  https://api.github.com/repos/YOUR-ORG/YOUR-REPO/security/secret-scanning
# List all alerts (open secrets detected)
curl -H "Authorization: Bearer ${GITHUB_TOKEN}" \
  -H "Accept: application/vnd.github+json" \
  https://api.github.com/repos/YOUR-ORG/YOUR-REPO/secret-scanning/alerts

What GitHub Scans For

GitHub maintains a [partner program](https://docs.github.com/en/code-security/secret-scanning/secret-scanning-patterns) of over 200 token patterns including:

• AWS access key IDs and secrets
• GitHub personal access tokens and OAuth tokens
• Google API keys and service account credentials
• Stripe, Twilio, Slack, and other SaaS API keys
• Private SSH keys, database connection strings, and JWT secrets

You can also define custom patterns using regex to catch internal tokens or secrets specific to your stack.

Push Protection: The Stronger Control

Secret scanning without push protection is a detection control — it tells you after a secret was committed. Push protection is a prevention control — it blocks the commit entirely.

For SOC 2 CC8.1 (Change Management), prevention is stronger than detection. If your auditor asks "what prevents a developer from committing a credential?", push protection gives you a concrete answer.

To enable push protection via the API:

curl -X PATCH \

  -H "Authorization: Bearer ${GITHUB_TOKEN}" \
  -H "Accept: application/vnd.github+json" \
  https://api.github.com/repos/YOUR-ORG/YOUR-REPO \
  -d '{"security_and_analysis": {"secret_scanning_push_protection": {"status": "enabled"}}}'

What Auditors Look For

SOC 2 auditors testing your GitHub environment will typically request:

Configuration evidence — screenshot or API output showing secret scanning is enabled on all repositories

Alert handling evidence — a log showing that secret scanning alerts were reviewed and resolved, not ignored

Push protection evidence — confirmation that push protection blocks secrets at commit time (not just post-commit)

Scope confirmation — that scanning covers all repositories, not just selected ones

Common audit findings:

• Secret scanning enabled on some repositories but not all
• Push protection disabled (detection-only, not prevention)
• Open secret scanning alerts with no remediation record
• Secret scanning enabled but no documented process for handling alerts

GitHub SOC 2 Compliance: The Full Picture

Secret scanning is one of several GitHub controls SOC 2 auditors test. The full GitHub control surface for SOC 2 includes:

|---|---|---| The [GitHub branch protection SOC 2 guide](/blog/github-branch-protection-soc2) covers branch protection in depth. The [GitHub Actions CI/CD security guide](/blog/github-actions-cicd-security-soc2) covers your deployment pipeline.

Automating Secret Scanning Evidence Collection

Manual evidence collection — downloading screenshots of the secret scanning settings page every audit cycle — is error-prone and time-consuming.

SecureSpect runs a continuous check (github.actions.secret_scanning) against your connected GitHub organization. The check:

• Verifies secret scanning is enabled on every repository in scope
• Confirms push protection status
• Captures a point-in-time evidence record with timestamp and checksum
• Flags any repository where scanning is disabled or push protection is off
• Exports findings to your auditor workspace automatically

The result is a live control record your auditor can review directly — no screenshots, no manual exports, no audit scramble.