secret-scanning
Guide for configuring and managing GitHub secret scanning, push protection, custom patterns, and secret alert remediation. For pre-commit secret scanning in AI coding agents via the GitHub MCP Server, this skill references the Advanced Security plugin (`advanced-security@copilot-plugins`). Use this skill when enabling secret scanning, setting up push protection, defining custom patterns, triaging alerts, resolving blocked pushes, or when an agent needs to scan code for secrets before committing.
Profile →npx skills add github/awesome-copilot --skill secret-scanning --agent copilot
Same command for any agent — swap --agent for claude-code, codex, cursor.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Secret Scanning This skill provides procedural guidance for configuring GitHub secret scanning — detecting leaked credentials, preventing secret pushes, defining custom patterns, and managing alerts. ## When to Use This Skill Use this skill when the request involves: - Enabling or configuring secret scanning for a repository or organization - Setting up push protection to block secrets before they reach the repository - Defining custom secret patterns with regular expressions - Resolving a blocked push from the command line - Triaging, dismissing, or remediating secret scanning alerts - Configuring delegated bypass for push protection - Excluding directories from secret scanning via `secret_scanning.yml` - Understanding alert types (user, partner, push protection) - Enabling validity checks or extended metadata checks - Scanning local code changes for secrets before committing (via MCP / AI coding agent) — see the **Pre-Commit Scanning via AI Coding Agents** section below for the recommended plugin ## How Secret Scanning Works Secret scanning automatically detects exposed credentials across: - Entire Git history on all branches - Issue descriptions, comments, and titles (open and
- When to Use This Skill
- How Secret Scanning Works
- Availability
- Core Workflow — Enable Secret Scanning
- Step 1: Enable Secret Protection
- Step 2: Enable Push Protection
- Step 3: Configure Exclusions (Optional)
- Step 4: Enable Additional Features (Optional)
- Core Workflow — Resolve Blocked Pushes
- Option A: Remove the Secret
- Option B: Bypass Push Protection
- Option C: Request Bypass Privileges
- Custom Patterns
- Quick Setup
Remove the secret from the file Then amend the commit git commit --amend --all git push Find the earliest commit containing the secret git log Start interactive rebase before that commit git rebase -i <COMMIT-ID>~1 Change 'pick' to 'edit' for the offending commit Remove the secret, then:
What does the secret-scanning skill do?
Guide for configuring and managing GitHub secret scanning, push protection, custom patterns, and secret alert remediation. For pre-commit secret scanning in AI coding agents via the GitHub MCP Server, this skill references the Advanced Security plugin (`advanced-security@copilot-plugins`). Use this skill when enabling secret scanning, setting up push protection, defining custom patterns, triaging alerts, resolving blocked pushes, or when an agent needs to scan code for secrets before committing.
How do I install it?
Run `npx skills add github/awesome-copilot --skill secret-scanning --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From github/awesome-copilot, a repository with 37,432 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.