GitHub Activates Default System for API Token Protection

GitHub has recently announced a new security measure that will now be the default for all public repositories. This mechanism aims to protect repositories from the inadvertent inclusion of confidential data left by developers in the code. This includes sensitive information such as passwords to databases, tokens, and access keys to APIs. Previously, scans for such leaks were done passively, but now they will be automatically conducted at the time of publication (Git Push). Any attempt to add commits that contain confidential data will trigger a warning, alerting the developer to the presence of such information.

In order to enhance this security feature, GitHub has implemented over 250 templates for identifying various types of keys, tokens, certificates, and sensitive data. These templates cover more than 180 different services, including major providers such as Amazon Web Services, Azure, Google Cloud, and more. To prevent false positives, only known token types are tested. In case of a potential leak, developers are prompted to address the issue by removing the problematic code, resolving the leak, and either resubmitting the command or marking it as invalid.