--- title: GitHub Secret Scanning Public Monitoring for... description: GitHub launched public monitoring for secret scanning (public preview for enterprises), which watches the entire public surface of github.com for leaked... canonical: https://daily.dev/posts/github-secret-scanning-public-monitoring-for-enterprises-coverage-and-gaps-txomrmpk3 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GitHub Secret Scanning Public Monitoring for Enterprises: Coverage and Gaps | daily.dev og:description: GitHub launched public monitoring for secret scanning (public preview for enterprises), which watches the entire public surface of github.com for leaked... og:url: https://daily.dev/posts/github-secret-scanning-public-monitoring-for-enterprises-coverage-and-gaps-txomrmpk3 og:image: https://api.daily.dev/og/posts/tXoMRmpK3.png og:image:alt: GitHub Secret Scanning Public Monitoring for Enterprises: Coverage and Gaps og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GitHub Secret Scanning Public Monitoring for Enterprises: Coverage and Gaps **[StepSecurity](https://daily.dev/sources/stepsecurity)** · 5 min read · 3 upvotes · 0 comments ## Summary GitHub launched public monitoring for secret scanning (public preview for enterprises), which watches the entire public surface of github.com for leaked enterprise secrets — not just owned repositories. It covers git content, pull request comments, and issues in real time, attributing leaks via GitHub's identity layer. The feature is free for GitHub Enterprise Cloud customers with Secret Protection or Advanced Security. However, it has significant gaps: it cannot detect secrets exfiltrated to attacker-controlled infrastructure, workflow run logs are not confirmed as a scanned surface, and detection is always after-the-fact. Real-world attacks like Sha1-Hulud, Megalodon, and GhostAction demonstrate these blind spots. The recommended layered approach combines GitHub's public monitoring with runtime egress control (e.g., Harden-Runner) to block exfiltration at the network layer before secrets ever reach a public surface. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What does GitHub's public monitoring for secret scanning cover for enterprises? It scans public content across all of github.com in real time, not just enterprise-owned repositories, covering git content, pull request comments, and GitHub issues. Leaks are attributed back to the enterprise using GitHub's identity layer and verified domains rather than guessing from commit emails. It shipped July 1, is in public preview, and is free for GitHub Enterprise Cloud customers with Secret Protection or Advanced Security. _Teams rolling out GitHub secret scanning can track how coverage evolves through daily.dev._ ### Does GitHub's public secret scanning monitoring catch secrets exfiltrated through GitHub Actions workflow logs? No, workflow run logs are not listed among the scanned surfaces; GitHub's announcement and documentation list git content, commits, issues, pull requests, discussions, and gists, but not build logs. This matters because the tj-actions/changed-files compromise exposed CI/CD credentials specifically in build logs, so log-based exposure should be treated as outside this feature's scope until GitHub documents otherwise. _Engineers hardening CI/CD pipelines can follow coverage gaps like this via daily.dev._ ### How was the Sha1-Hulud npm supply chain attack detected in practice? Harden-Runner detected the compromised packages running inside CNCF's Backstage repository through runtime network monitoring and baseline anomaly detection, catching the anomalous outbound traffic as it happened rather than after secrets were dumped publicly. This is separate from GitHub's public monitoring, which only detects secrets after they surface on github.com's public surface. _Teams evaluating runtime egress controls against supply chain attacks can dig deeper on daily.dev._ ## Similar posts on daily.dev - [Secret scanning public monitoring for enterprises](https://daily.dev/posts/secret-scanning-public-monitoring-for-enterprises-v2pkpwqj5) · GitHub Changelog · 0 upvotes · 0 comments - [GitGuardian Agents Analysis: Know If A Leak Is Yours](https://daily.dev/posts/gitguardian-agents-analysis-know-if-a-leak-is-yours-1zcgs8gtl) · GitGuardian · 0 upvotes · 0 comments - [GitHub’s public APIs are becoming an enterprise reconnaissance tool](https://daily.dev/posts/github-s-public-apis-are-becoming-an-enterprise-reconnaissance-tool-ty1kvhyvy) · InfoWorld · 0 upvotes · 0 comments - [How GitHub used secret scanning to reach inbox zero](https://daily.dev/posts/how-github-used-secret-scanning-to-reach-inbox-zero-26vbmbpb8) · GitHub Blog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#github](https://daily.dev/tags/github), [#cicd](https://daily.dev/tags/cicd), [#github-actions](https://daily.dev/tags/github-actions), [#appsec](https://daily.dev/tags/appsec) [View this post on daily.dev](https://daily.dev/posts/github-secret-scanning-public-monitoring-for-enterprises-coverage-and-gaps-txomrmpk3) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GitHub Secret Scanning Public Monitoring for Enterprises: Coverage and Gaps","url":"https://daily.dev/posts/github-secret-scanning-public-monitoring-for-enterprises-coverage-and-gaps-txomrmpk3","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/github-secret-scanning-public-monitoring-for-enterprises-coverage-and-gaps-txomrmpk3"},"datePublished":"2026-07-07T22:05:32.353Z","dateModified":"2026-09-14T08:43:28.971Z","description":"GitHub launched public monitoring for secret scanning (public preview for enterprises), which watches the entire public surface of github.com for leaked...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/30978cf00a85eba4e023adcd493965d3?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/30978cf00a85eba4e023adcd493965d3?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"StepSecurity","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"StepSecurity","logo":"https://media.daily.dev/image/upload/s--vegWii-S--/f_auto,q_auto/v1774959924/logos/stepsecurity?_a=BAMAMiWQ0","url":"https://daily.dev/sources/stepsecurity"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/github-secret-scanning-public-monitoring-for-enterprises-coverage-and-gaps-txomrmpk3","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,github,cicd,github-actions,appsec","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"StepSecurity","item":"https://daily.dev/sources/stepsecurity"},{"@type":"ListItem","position":3,"name":"GitHub Secret Scanning Public Monitoring for Enterprises: Coverage and Gaps"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/github-secret-scanning-public-monitoring-for-enterprises-coverage-and-gaps-txomrmpk3#faq","mainEntity":[{"@type":"Question","name":"What does GitHub's public monitoring for secret scanning cover for enterprises?","acceptedAnswer":{"@type":"Answer","text":"It scans public content across all of github.com in real time, not just enterprise-owned repositories, covering git content, pull request comments, and GitHub issues. Leaks are attributed back to the enterprise using GitHub's identity layer and verified domains rather than guessing from commit emails. It shipped July 1, is in public preview, and is free for GitHub Enterprise Cloud customers with Secret Protection or Advanced Security. Teams rolling out GitHub secret scanning can track how coverage evolves through daily.dev."}},{"@type":"Question","name":"Does GitHub's public secret scanning monitoring catch secrets exfiltrated through GitHub Actions workflow logs?","acceptedAnswer":{"@type":"Answer","text":"No, workflow run logs are not listed among the scanned surfaces; GitHub's announcement and documentation list git content, commits, issues, pull requests, discussions, and gists, but not build logs. This matters because the tj-actions/changed-files compromise exposed CI/CD credentials specifically in build logs, so log-based exposure should be treated as outside this feature's scope until GitHub documents otherwise. Engineers hardening CI/CD pipelines can follow coverage gaps like this via daily.dev."}},{"@type":"Question","name":"How was the Sha1-Hulud npm supply chain attack detected in practice?","acceptedAnswer":{"@type":"Answer","text":"Harden-Runner detected the compromised packages running inside CNCF's Backstage repository through runtime network monitoring and baseline anomaly detection, catching the anomalous outbound traffic as it happened rather than after secrets were dumped publicly. This is separate from GitHub's public monitoring, which only detects secrets after they surface on github.com's public surface. Teams evaluating runtime egress controls against supply chain attacks can dig deeper on daily.dev."}}]} ```