Back to Checks
github

Repository has secret scanning enabled to detect sensitive data

repository_secret_scanning_enabled
Service: repositorySeverity: high
OfficialBuilt-inVerified
Categories:secrets
Resource Type:NotDefined

GitHub repository configuration for secret scanning-which detects secrets (API keys, tokens, passwords) in commits and Git history-is evaluated to determine if detection is active.

Prowler logoProwlerprowler-provider-github

Risk

Without secret scanning, exposed credentials can persist unnoticed, enabling:

  • Unauthorized access to cloud and third-party services
  • Supply-chain compromise via tampered pipelines
  • Data exfiltration and repo takeover

This degrades confidentiality and integrity, and increases blast radius of a single leaked key.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler github --checks repository_secret_scanning_enabled

Recommendation

Enable secret scanning (and push protection where available) across repositories.

  • Store secrets in a dedicated secrets manager, never in code
  • Define custom patterns and enable generic detection for org-specific secrets
  • Rotate and revoke exposed credentials quickly
  • Enforce least privilege and add defense-in-depth monitoring

Remediation

CLI

gh api -X PATCH repos/<OWNER>/<REPO> -H "Accept: application/vnd.github+json" -H "Content-Type: application/json" -d '{"security_and_analysis":{"secret_scanning":{"status":"enabled"}}}'

Terraform

resource "github_repository" "<example_resource_name>" {
  name = "<example_resource_name>"

  security_and_analysis {
    secret_scanning {           # Critical: enable secret scanning
      status = "enabled"       # Turns on secret scanning for the repository
    }
  }
}

Other

1In GitHub, open the target repository and go to Settings
2In the left sidebar, click Code security and analysis
3Under Secret scanning, click Enable (or set to Enabled)
4Confirm if prompted

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGithub
from prowler.providers.github.services.repository.repository_client import (
    repository_client,
)


class repository_secret_scanning_enabled(Check):
    """Check if secret scanning is enabled to detect sensitive data in the repository

    This class verifies whether each repository has secret scanning enabled.
    """

    def execute(self) -> List[CheckReportGithub]:
        """Execute the Github Repository Secret Scanning check

        Iterates over all repositories and checks if secret scanning is enabled.

        Returns:
            List[CheckReportGithub]: A list of reports for each repository
        """
        findings = []
        for repo in repository_client.repositories.values():
            if repo.secret_scanning_enabled is not None:
                report = CheckReportGithub(metadata=self.metadata(), resource=repo)
                if getattr(repo, "secret_scanning_enabled", None):
                    report.status = "PASS"
                    report.status_extended = f"Repository {repo.name} has secret scanning enabled to detect sensitive data."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"Repository {repo.name} does not have secret scanning enabled to detect sensitive data."

                findings.append(report)

        return findings

References