Monitoring alerts from secret scanning

Learn how and when GitHub will notify you about a secret scanning alert.

Who can use this feature?

Repository owners, organization owners, security managers, and users with the admin role

Configuring notifications for secret scanning alerts

In addition to displaying an alert in the Security tab of the repository, GitHub can also send email notifications for alerts. These notifications are different for incremental scans and historical scans.

Incremental scans

When a new secret is detected, GitHub notifies all users with access to security alerts for the repository according to their notification preferences. These users include:

Repository administrators
Security managers
Users with custom roles with read/write access
Organization owners and enterprise owners, if they are administrators of repositories where secrets were leaked

Note

Commit authors who've accidentally committed secrets will be notified, regardless of their notification preferences.

You will receive an email notification if:

You are watching the repository.
You have enabled notifications for "All Activity", or for custom "Security alerts" on the repository.
In your notification settings, under "Subscriptions", then under "Watching", you have selected to receive notifications by email.

On GitHub, navigate to the main page of the repository.
To start watching the repository, select Watch.
In the dropdown menu, click All Activity. Alternatively, to only subscribe to security alerts, click Custom, then click Security alerts.
Navigate to the notification settings for your personal account. These are available at https://github.com/settings/notifications.
On your notification settings page, under "Subscriptions", then under "Watching", select the Notify me dropdown.
Select "Email" as a notification option, then click Save.

For more information about setting up notification preferences, see "Managing security and analysis settings for your repository" and "Configuring your watch settings for an individual repository."

Historical scans

For historical scans, GitHub notifies the following users:

Organization owners, enterprise owners, and security managers—whenever a historical scan is complete, even if no secrets are found.
Repository administrators, security managers, and users with custom roles with read/write access—whenever a historical scan detects a secret, and according to their notification preferences.

We do not notify commit authors.