Secret scanning
One of the most common attack vectors is secrets in plain text files. Secrets should never be stored unencrypted and unprotected. GitHub helps you with this by constantly scanning all your public repositories for secrets. You can also enable this for private repositories that belong to an organization where GitHub Advanced Security is enabled.
Currently, there are nearly 100 secrets in public and 145 in private repositories that get detected – Adobe, Alibaba, Amazon, Atlassian, Azure, and so on. For a complete list, see https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning.
As a service provider, you can sign up for the secret scanning partner program (see https://docs.github.com/en/developers/overview/secret-scanning-partner-program). Your secrets get detected by a regular expression and are then sent to an endpoint, where you can verify whether the secret is real or whether it is a false positive. It is the decision of the partner...
