---
id: "githubsecretscanning"
category: "detector"
url: "https://registry.apicrafter.io/tool/githubsecretscanning"
---

# GitHub secret scanning (`githubsecretscanning`)

Built-in GitHub service that scans repositories, issues, pull requests and discussions for committed credentials and can block pushes that contain them. Most patterns are provider-specific token formats, many of them supplied by the service providers through GitHub's partner program, which also lets providers revoke leaked tokens. A smaller set of generic patterns covers private keys, database connection strings and HTTP authentication headers, and passwords are found with an AI model. The reference page lists nearly 500 patterns; the supported types cover only the registry datatypes that match one of them.

Website: <https://docs.github.com/en/code-security/reference/secret-security/supported-secret-scanning-patterns>

## Supported datatypes (95)

- `airtable_personal_access_token`
- `anthropic_api_key`
- `atlassian_api_token`
- `aws_access_key_id`
- `aws_secret_access_key`
- `azure_ai_services_key`
- `azure_cache_redis_key`
- `azure_cosmosdb_key`
- `azure_devops_pat`
- `azure_entra_client_secret`
- `azure_function_key`
- `azure_storage_account_key`
- `clojars_deploy_token`
- `cloudflare_api_token`
- `cloudflare_global_api_key`
- `connection_string`
- `databricks_access_token`
- `digitalocean_token`
- `discord_bot_token`
- `doppler_token`
- `dropbox_short_lived_token`
- `dynatrace_token`
- `facebook_access_token`
- `flutterwave_secret_key`
- `github_token`
- `gitlab_agent_token`
- `gitlab_cicd_job_token`
- `gitlab_deploy_token`
- `gitlab_feature_flags_client_token`
- `gitlab_feed_token`
- `gitlab_incoming_mail_token`
- `gitlab_oauth_app_secret`
- `gitlab_pat`
- `gitlab_runner_token`
- `gitlab_scim_token`
- `gitlab_trigger_token`
- `google_api_key`
- `grafana_cloud_token`
- `grafana_service_account_token`
- `hashicorp_vault_token`
- `heroku_oauth_token`
- `http_authorization_header`
- `huggingface_access_token`
- `jfrog_api_key`
- `jfrog_reference_token`
- `linear_api_key`
- `mailchimp_api_key`
- `mailgun_api_key`
- `mapbox_access_token`
- `new_relic_insights_key`
- `new_relic_license_key`
- `new_relic_user_api_key`
- `notion_integration_token`
- `npm_access_token`
- `onepassword_service_account_token`
- `openai_api_key`
- `openrouter_api_key`
- `openssh_private_key`
- `password`
- `pgp_private_key_block`
- `planetscale_password`
- `planetscale_token`
- `posthog_personal_api_key`
- `postman_api_key`
- `prefect_api_key`
- `pulumi_access_token`
- `pypi_token`
- `replicate_api_token`
- `rubygems_api_key`
- `sendgrid_api_key`
- `sendinblue_api_key`
- `sentry_auth_token`
- `shared_access_signature`
- `shippo_api_token`
- `shopify_access_token`
- `shopify_shared_secret`
- `slack_token`
- `slack_webhook_url`
- `square_access_token`
- `square_oauth_secret`
- `stripe_api_key`
- `stripe_webhook_secret`
- `supabase_personal_access_token`
- `supabase_secret_key`
- `telegram_bot_token`
- `terraform_cloud_api_token`
- `twilio_account_sid`
- `twilio_api_key_sid`
- `typeform_personal_access_token`
- `uri_with_password`
- `vercel_token`
- `x509_private_key`
- `yandex_cloud_api_key`
- `yandex_cloud_iam_token`
- `yandex_oauth_token`