GitHub secret scanning alert: what to do next
Where it shows upRepository > Security tab > Secret scanning
Alert: <secret type> detected in <file> (commit <sha>)
# plus an email to the commit authorRevoke or rotate the secret with the service it belongs to first. Deleting it from the code is not enough, because it stays in git history and anyone may already have it.
Why it happens
GitHub scans repositories for known secret formats. On public repositories, many token types are also reported straight to the provider (for example AWS, OpenAI, Stripe), who may revoke the key or contact you. GitHub automatically revokes its own tokens pushed to public repositories.
GitHub's remediation guide calls revoking the secret the most important step, and says it is not sufficient to simply remove the secret from your codebase.
Fix it by hand
- Identify the provider. The alert names the secret type. The provider is the service the key belongs to, not GitHub (unless it's a GitHub token).
- Revoke and replace it in that provider's dashboard. Guides for the common ones: OpenAI, AWS, Stripe.
- Check for misuse. Look at your GitHub security log or organization audit log, and at the provider's own logs (for example AWS CloudTrail) for activity you didn't do.
- Fix the code. Read the secret from an environment variable or secret store, update every service with the new value, and test that they still work.
- Close the alert with "Close as" and the reason Revoked, and write down what happened.
- Decide on history cleanup. GitHub says it is ideal to remove every instance, but that cleaning history is destructive and disruptive. Once the key is rotated, the old value is useless. If you still want it gone, see removing a secret from git history.
Stop it happening again
- Keep push protection on, so supported secrets are blocked before they're pushed.
- Add
.env*to.gitignoreon day one, and commit only a.env.examplewith placeholder values. - Check for secrets before you make a repository public, including every branch and old commit.
Key Leaked $7
Paste the alert. Key Leaked tells you which provider the secret belongs to, finds every place it lives (files, commits, branches, build output), gives that provider's exact revoke-and-replace steps, and tells you when an alert looks like phishing or is about a key that is public by design.
- Finds every secret in your files, every commit on every branch, and the JavaScript you ship to browsers.
- Gives exact revoke-and-replace steps for 19 providers, and never prints your full secrets.
- Verdict first. Every finding shows the file and line, what it breaks, and the fix as a diff that is applied only with your OK.
Key Leaked: how it works, with examples · Install guide
Works with Claude Code, Claude.ai, Cursor, Codex and other agents that read SKILL.md files. No installs, no accounts, works offline. No-questions refund.