GitHub Leaked Secrets

• Environment and example configuration files.
• CI/CD workflows, build logs, and deployment scripts.
• Infrastructure-as-code variables and state references.
• Documentation, issue bodies, sample requests, and notebooks.
• Removed files in commit history and long-lived forks.
• Generated bundles, source maps, and mobile configuration.

Combine one scope qualifier with content or path terms. Add language, path, fork, or archive constraints to reduce noise. Exact repository qualifiers require the full owner/name.

org:example-corp ("BEGIN PRIVATE KEY" OR "client_secret")
org:example-corp path:.github/workflows ("secrets." OR "permissions:")
repo:example-corp/sample (path:.env OR path:config)
org:example-corp "AKIA" NOT path:test NOT path:fixtures

• Prefer provider or configuration vocabulary over generic words such as password.
• Exclude tests, fixtures, vendored, and generated content when appropriate.
• Review archived repositories and relevant forks separately.
• Record the exact query and discovery timestamp.

Compose an encoded GitHub Code Search URL locally. Authorization confirmation is required before the external search button is enabled.

1. 01

   Identify provider and secret type from documented format.

2. 02

   Confirm the repository and value belong to the authorized organization.

3. 03

   Notify the provider or internal owner through the agreed channel.

4. 04

   Have the owner revoke or rotate the secret.

5. 05

   Review provider logs for use from creation until revocation.

6. 06

   Remove current and historical exposure where appropriate.

• Revoke before rewriting Git history.
• Rotate downstream credentials derived from the exposed secret.
• Invalidate sessions and review audit logs.
• Enable GitHub secret scanning and push protection.
• Add custom patterns for organization-specific tokens.
• Move secrets to a managed store and prefer short-lived identity federation.