GitHub secret-leak monitoring gets triage, an API and webhooks
Public monitoring, which attributes leaked secrets found anywhere on the public internet back to your org, adds alert management, validity checks, a REST endpoint and a webhook event.
GitHub’s public monitoring, the feature that scans the whole public internet for secrets belonging to your organisation and attributes them back to you, shipped a batch of operational tooling on 23 October. You can now dismiss or reopen alerts with comments, filter by repository, committer, secret type and status, and see a timeline of every state change.
The bigger addition is automatic validity checking: GitHub now tests whether a leaked credential still works for supported providers and marks it Active, Inactive or Unknown, so a team can triage by what’s actually exploitable rather than working through every match in order. A new REST endpoint, GET /enterprises/{enterprise}/secret-scanning/public-monitoring-alerts, and a secret_scanning_public_monitoring_alert webhook let you pull findings into your own incident tooling instead of checking a dashboard. It’s included free with an Advanced Security or Secret Protection licence, and it’s in public preview for GitHub Enterprise Cloud.
Why it matters: a leaked key sitting in a public repo or gist is useless to flag if nobody sees it for days. Validity checking tells you which alerts need a rotation right now, and the webhook means that can trigger automatically instead of waiting on someone to check a dashboard.