GitHub secret scanning
ID githubsecretscanning
detector
Built-in GitHub service that scans repositories, issues, pull requests and discussions for committed credentials and can block pushes that contain them. Most patterns are provider-specific token formats, many of them supplied by the service providers through GitHub's partner program, which also lets providers revoke leaked tokens. A smaller set of generic patterns covers private keys, database connection strings and HTTP authentication headers, and passwords are found with an AI model. The reference page lists nearly 500 patterns; the supported types cover only the registry datatypes that match one of them.
- Website
- https://docs.github.com/en/code-security/reference/secret-security/supported-secret-scanning-patterns
- Supported types
- 95
Supported semantic types
| ID | Name | Categories | Countries | Description |
|---|---|---|---|---|
| airtable_personal_access_token | Airtable personal access token draft | secrets | global | Personal access token of the Airtable Web API, which replaced the deprecated API keys in February 2024. Airtable does not publish the... |
| anthropic_api_key | Anthropic API key draft | secrets | global | Secret key of the Anthropic (Claude) API, sent in the x-api-key header. Standard keys start with sk-ant-api03- and Admin API keys, which... |
| atlassian_api_token | Atlassian API token draft | secrets | global | API token of an Atlassian account (Jira, Confluence and other Atlassian cloud products). Current tokens start with ATATT3; secret... |
| aws_access_key_id | AWS access key ID draft | secrets | global | Public half of an Amazon Web Services access key pair, sent with every signed API request together with the secret access key. It has 20... |
| aws_secret_access_key | AWS secret access key draft | secrets | global | Secret part of an Amazon Web Services access key pair, used with the access key ID to sign API requests (for example to Amazon S3): 40... |
| azure_ai_services_key | Azure AI services key (Azure OpenAI, Cognitive Services) draft | secrets | global | Key of an Azure AI services resource, including Azure OpenAI and the former Cognitive Services, sent in the api-key or... |
| azure_cache_redis_key | Azure Cache for Redis access key draft | secrets | global | Access key of Azure Cache for Redis, used as the password in Redis connection strings. Keys in the identifiable format are 44 Base64... |
| azure_cosmosdb_key | Azure Cosmos DB account key draft | secrets | global | Account key of Azure Cosmos DB, the AccountKey of a Cosmos DB connection string, which grants administrative access to the account. It... |
| azure_devops_pat | Azure DevOps personal access token draft | secrets | global | Personal access token of Azure DevOps, used instead of a password for Git, the REST API and package feeds. Tokens in the current format... |
| azure_entra_client_secret | Microsoft Entra ID client secret draft | secrets | global | Client secret of a Microsoft Entra ID (Azure AD) application registration, used by a service principal to obtain tokens. Microsoft... |
| azure_function_key | Azure Functions key draft | secrets | global | Function, host or master key of Azure Functions, sent as the code query parameter or the x-functions-key header to call an... |
| azure_storage_account_key | Azure Storage account key draft | secrets | global | Access key of an Azure Storage account: 512 bits encoded in Base64, which gives 86 characters followed by two equals signs. |
| clojars_deploy_token | Clojars deploy token draft | secrets | global | Token with which a build tool deploys artifacts to the Clojars repository instead of a password. Deploy tokens start with CLOJARS_, as... |
| cloudflare_api_token | Cloudflare API token draft | secrets | global | Scoped API token of Cloudflare. Tokens created or rolled in the scannable format start with cfut_ (user API token) or cfat_ (account API... |
| cloudflare_global_api_key | Cloudflare Global API Key draft | secrets | global | Global API Key of a Cloudflare user account, which grants full access to the account. Keys in the scannable format start with cfk_,... |
| connection_string | Connection string with credentials draft | secrets | global | Connection string of a database or a cloud service that includes a password or an access key, for example Server=...;User... |
| databricks_access_token | Databricks personal access token draft | secrets | global | Personal access token of Databricks, used to authenticate to a Databricks workspace. It starts with dapi followed by 32 hexadecimal... |
| digitalocean_token | DigitalOcean API token draft | secrets | global | API token of DigitalOcean. The prefix tells the token type: dop_v1_ for a personal access token, doo_v1_ for an OAuth access token and... |
| discord_bot_token | Discord bot token draft | secrets | global | Token that authenticates a Discord bot to the Discord API, sent in the header Authorization: Bot <token>. It has three Base64url parts... |
| doppler_token | Doppler token draft | secrets | global | Access token of the Doppler secrets manager. Doppler documents one format per token type, each starting with dp. and a type code: dp.pt.... |
| dropbox_short_lived_token | Dropbox short-lived access token draft | secrets | global | Short-lived OAuth access token of the Dropbox API. Dropbox staff state that these tokens start with sl., while the deprecated long-lived... |
| dynatrace_token | Dynatrace token draft | secrets | global | Access token of Dynatrace in the format used since Dynatrace version 1.210: a prefix that names the token type (dt0 followed by a letter... |
| facebook_access_token | Meta (Facebook) Graph API access token draft | secrets | global | User, page or system user access token of the Meta (Facebook) Graph API. These tokens start with EAA followed by a long string of... |
| flutterwave_secret_key | Flutterwave secret key draft | secrets | global | Secret API key of the Flutterwave payments API. Flutterwave documents that secret keys start with FLWSECK and that test keys add _TEST... |
| github_token | GitHub token draft | secrets | global | Token issued by GitHub, such as a personal access token. It starts with a prefix that names the token type (ghp_, gho_, ghu_, ghs_ or... |
| gitlab_agent_token | GitLab agent for Kubernetes token draft | secrets | global | Token with which the GitLab agent for Kubernetes, running in a cluster, authenticates to GitLab. GitLab gives these tokens the prefix... |
| gitlab_cicd_job_token | GitLab CI/CD job token draft | secrets | global | Short-lived token that GitLab creates for each CI/CD job (CI_JOB_TOKEN) to call the API and fetch artifacts and packages during the job.... |
| gitlab_deploy_token | GitLab deploy token draft | secrets | global | Token that gives read or write access to the repositories, container registry or package registry of one GitLab project or group,... |
| gitlab_feature_flags_client_token | GitLab feature flags client token draft | secrets | global | Token with which applications fetch the feature flags of a GitLab project through its Unleash-compatible API. GitLab gives these tokens... |
| gitlab_feed_token | GitLab feed token draft | secrets | global | Token in the URLs of GitLab RSS and Atom feeds and calendar feeds; it gives read access to the activity of the user. GitLab gives these... |
| gitlab_incoming_mail_token | GitLab incoming mail token draft | secrets | global | Token in the email address to which a user sends mail to create issues or merge requests in a GitLab project. GitLab gives these tokens... |
| gitlab_oauth_app_secret | GitLab OAuth application secret draft | secrets | global | Client secret of an OAuth application registered in GitLab. GitLab gives these tokens the prefix gloas-, which cannot be configured.... |
| gitlab_pat | GitLab personal access token draft | secrets | global | Personal access token of GitLab, which authenticates a user to the GitLab API and to Git over HTTPS. GitLab gives these tokens the... |
| gitlab_runner_token | GitLab runner authentication token draft | secrets | global | Token with which a GitLab Runner authenticates to a GitLab instance to pick up CI/CD jobs. GitLab gives these tokens the prefix glrt-... |
| gitlab_scim_token | GitLab SCIM token draft | secrets | global | Token with which an identity provider provisions and deprovisions GitLab users and group members through the SCIM API. GitLab gives... |
| gitlab_trigger_token | GitLab pipeline trigger token draft | secrets | global | Token that starts a CI/CD pipeline of a GitLab project through the pipeline triggers API. GitLab gives these tokens the prefix glptt-,... |
| google_api_key | Google API key draft | secrets | global | API key for Google Cloud and Google Maps APIs: the prefix AIza followed by 35 letters, digits, hyphens or underscores. |
| grafana_cloud_token | Grafana Cloud access policy token draft | secrets | global | Token of a Grafana Cloud access policy, used by agents and API clients to send and query telemetry. Grafana documents that these tokens... |
| grafana_service_account_token | Grafana service account token draft | secrets | global | Token of a Grafana service account, sent as a bearer token to the Grafana HTTP API: glsa_ followed by 32 letters and digits, an... |
| hashicorp_vault_token | HashiCorp Vault token draft | secrets | global | Token that authenticates a client to HashiCorp Vault. Since Vault 1.10 the prefix names the token type - hvs. for service tokens, hvb.... |
| heroku_oauth_token | Heroku API OAuth access token draft | secrets | global | OAuth access token of the Heroku Platform API, which the Heroku CLI also uses. Tokens granted from April 2024 start with HRKU-: until... |
| http_authorization_header | HTTP Authorization header value draft | secrets | global | Value of the HTTP Authorization request header: an authentication scheme such as Basic, Bearer, Digest or Negotiate followed by the credentials. |
| huggingface_access_token | Hugging Face access token draft | secrets | global | User access token of the Hugging Face Hub, used in place of a password for git, as a bearer token for Inference Providers and in the... |
| jfrog_api_key | JFrog Artifactory API key draft | secrets | global | Deprecated API key of JFrog Artifactory: the prefix AKCp followed by 69 letters and digits (the format that the gitleaks secret scanner... |
| jfrog_reference_token | JFrog reference token draft | secrets | global | Short token of the JFrog Platform (Artifactory) that refers to a full JWT access token. It has 64 characters: the prefix cmVmd followed... |
| linear_api_key | Linear API key draft | secrets | global | Personal API key of Linear, the issue tracking service: lin_api_ followed by 40 letters and digits. |
| mailchimp_api_key | Mailchimp API key draft | secrets | global | API key of the Mailchimp Marketing API: 32 hexadecimal digits, a hyphen and the data center of the account (for example us6), which is... |
| mailgun_api_key | Mailgun API key draft | secrets | global | Private API key of Mailgun, the password of HTTP Basic authentication with the user name api. The regexp covers the older form key-... |
| mapbox_access_token | Mapbox access token draft | secrets | global | Access token of the Mapbox APIs. Mapbox documents three kinds by prefix: public tokens (pk), meant to be embedded in client... |
| new_relic_insights_key | New Relic Insights insert or query key draft | secrets | global | Older New Relic key for the Insights event insert API (insert key) or the Insights query API (query key). New Relic does not publish the... |
| new_relic_license_key | New Relic license key draft | secrets | global | Ingest license key of a New Relic account, used by agents to report data. New Relic documents it as a 40-character key that ends in... |
| new_relic_user_api_key | New Relic user key draft | secrets | global | User key of New Relic, a personal API key that NerdGraph, New Relic's GraphQL API, requires for querying data and changing... |
| notion_integration_token | Notion integration token draft | secrets | global | API token of a Notion integration. Tokens generated since 25 September 2024 start with ntn_; older tokens start with secret_ and keep... |
| npm_access_token | npm access token draft | secrets | global | Access token of the npm package registry in the format introduced in 2021: the prefix npm_ followed by 36 letters and digits, the last... |
| onepassword_service_account_token | 1Password service account token draft | secrets | global | Token of a 1Password service account. 1Password gives it the prefix ops_ so that code analyzers can find it; the rest is a... |
| openai_api_key | OpenAI API key draft | secrets | global | Secret key of the OpenAI API. Keys start with sk-; project, service account and admin keys start with sk-proj-, sk-svcacct- or... |
| openrouter_api_key | OpenRouter API key draft | secrets | global | API key of OpenRouter. The OpenRouter API reference shows key labels that start with sk-or-v1-; the format is not described in prose.... |
| openssh_private_key | OpenSSH private key draft | secrets, cryptography | global | Private key in the OpenSSH key format (openssh-key-v1): a Base64 block between the lines -----BEGIN OPENSSH PRIVATE KEY----- and... |
| password | Password PII draft | common, pii | global | Passwords, usually associated with login/username/email. |
| pgp_private_key_block | OpenPGP private key block draft | secrets, cryptography | global | OpenPGP secret key in ASCII armor: Radix-64 text between the lines -----BEGIN PGP PRIVATE KEY BLOCK----- and -----END PGP PRIVATE KEY... |
| planetscale_password | PlanetScale database password draft | secrets | global | Password of a PlanetScale database: pscale_pw_ followed by 32 to 64 letters, digits and the characters _ = . -. |
| planetscale_token | PlanetScale API token draft | secrets | global | Token for the PlanetScale API and CLI: a service token starts with pscale_tkn_ and an OAuth token with pscale_oauth_. Secret scanners... |
| posthog_personal_api_key | PostHog personal API key draft | secrets | global | Personal API key of PostHog, which gives access to the private API endpoints of a user's projects. PostHog documents the prefix phx_.... |
| postman_api_key | Postman API key draft | secrets | global | API key of the Postman API, sent in the X-API-Key header: PMAK- followed by 24 hexadecimal digits, a hyphen and 34 more hexadecimal digits. |
| prefect_api_key | Prefect Cloud API key draft | secrets | global | API key of Prefect Cloud, used by workers and the Prefect client. Prefect does not publish the format; the regexp follows the gitleaks... |
| pulumi_access_token | Pulumi access token draft | secrets | global | Access token of Pulumi Cloud (a personal, organization or team token): pul- followed by 40 hexadecimal digits. |
| pypi_token | PyPI API token draft | secrets | global | API token of the Python Package Index, used to upload packages. It is a serialized macaroon with the prefix pypi-; PyPI documents that... |
| replicate_api_token | Replicate API token draft | secrets | global | API token of Replicate. Replicate documents that tokens are 40-character strings that always start with r8_; the regexp accepts letters... |
| rubygems_api_key | RubyGems API key draft | secrets | global | API key of RubyGems.org, used by the gem CLI to push and manage gems, for example through the GEM_HOST_API_KEY environment variable:... |
| sendgrid_api_key | SendGrid API key draft | secrets | global | API key of Twilio SendGrid, also used as the SMTP password. Keys are always 69 characters long and start with SG. followed by letters,... |
| sendinblue_api_key | Sendinblue API key draft | secrets | global | API key of the Sendinblue email marketing service: xkeysib- followed by 64 hexadecimal digits, a hyphen and 16 letters and digits. |
| sentry_auth_token | Sentry auth token draft | secrets | global | Auth token of Sentry, the error monitoring service. Personal (user) tokens are sntryu_ followed by 64 hexadecimal digits. Organization... |
| shared_access_signature | Azure shared access signature (SAS) draft | secrets | global | Shared access signature of Azure services (Storage, Service Bus, Logic Apps): a URL query string with permissions, an expiry time and a... |
| shippo_api_token | Shippo API token draft | secrets | global | API token of the Shippo shipping API. Shippo documents that live tokens start with shippo_live_ and test tokens with shippo_test_; the... |
| shopify_access_token | Shopify access token draft | secrets | global | Access token of a Shopify app. The prefix tells the kind of token: shpat_ for an app access token, shpca_ for a custom app and shppa_... |
| shopify_shared_secret | Shopify app shared secret draft | secrets | global | Shared secret of a Shopify app: the prefix shpss_ followed by 32 hexadecimal digits. |
| slack_token | Slack token draft | secrets | global | Access token of the Slack API. The prefix names the token type, for example xoxb- for bot tokens and xoxp- for user tokens. |
| slack_webhook_url | Slack incoming webhook URL draft | secrets | global | URL of a Slack incoming webhook or workflow trigger on hooks.slack.com. Anyone who knows the URL can post messages to the channel, so... |
| square_access_token | Square access token draft | secrets | global | Personal or OAuth access token of the Square APIs. Square does not document the format; secret scanners such as gitleaks recognize it by... |
| square_oauth_secret | Square OAuth application secret draft | secrets | global | Application secret of a Square developer application, which the application uses to exchange OAuth authorization codes for access... |
| stripe_api_key | Stripe secret or restricted API key draft | secrets | global | Server-side API key of Stripe. Secret keys start with sk_ and restricted keys with rk_, followed by test_ for a sandbox or live_ for... |
| stripe_webhook_secret | Stripe webhook signing secret draft | secrets | global | Secret with which a Stripe webhook endpoint verifies the signatures of the events it receives. Stripe documents that it starts with... |
| supabase_personal_access_token | Supabase personal access token draft | secrets | global | Personal access token of the Supabase Management API and CLI. Supabase shows these tokens with the prefix sbp_ and documents that tokens... |
| supabase_secret_key | Supabase secret key draft | secrets | global | Secret API key of a Supabase project, which bypasses row level security and must stay on the server. Supabase documents that secret keys... |
| telegram_bot_token | Telegram bot token draft | secrets | global | Token that authorizes a bot in the Telegram Bot API: the numeric bot ID, a colon and a secret that starts with A. Telegram documents the... |
| terraform_cloud_api_token | HashiCorp Terraform Cloud API token draft | secrets | global | User or organization API token of HashiCorp Terraform Cloud: 14 letters and digits, the marker .atlasv1. and 60 to 70 more letters,... |
| twilio_account_sid | Twilio Account SID draft | secrets | global | String identifier (SID) of a Twilio account: AC followed by 32 hexadecimal digits. It is the user name of Twilio API requests and is... |
| twilio_api_key_sid | Twilio API key SID draft | secrets | global | String identifier (SID) of a Twilio API key: SK followed by 32 hexadecimal digits. The SID is used together with the API key secret as... |
| typeform_personal_access_token | Typeform personal access token draft | secrets | global | Personal access token of the Typeform API. The Typeform documentation shows a sample token that starts with tfp_ followed by 40... |
| uri_with_password | URI with embedded password PII draft | secrets, internet | global | URI whose user information part contains a password, as in scheme://user:password@host/. RFC 3986 deprecates this form, but database and... |
| vercel_token | Vercel access token draft | secrets | global | Access token or API key of Vercel. Vercel documents a prefix for each credential type: vcp_ for personal access tokens, vci_ for... |
| x509_private_key | X.509 certificate private key draft | secrets, cryptography | global | Private key of an X.509 certificate, usually written as a PEM block that starts with -----BEGIN PRIVATE KEY----- (or RSA PRIVATE KEY, EC... |
| yandex_cloud_api_key | Yandex Cloud API key draft | secrets | global | API key of a Yandex Cloud service account. Yandex does not publish the format; the masked key in the Yandex Cloud documentation and the... |
| yandex_cloud_iam_token | Yandex Cloud IAM token draft | secrets | global | Short-lived IAM token of Yandex Cloud, sent in the Authorization: Bearer header. The regexp is the one that the Yandex Cloud... |
| yandex_oauth_token | Yandex OAuth token draft | secrets | global | OAuth token of a Yandex account (Yandex ID), which Yandex Cloud also accepts to obtain IAM tokens. Yandex documents that the token... |
Use this record
- JSON: API v1 · legacy shape
- Improve it: edit
data/tools/detectors/githubsecretscanning.yamlon GitHub