Safety #Coding agents Oct 25, 2026 · Originally published Oct 23

GitHub public monitoring adds triage, continuous validity checks, a REST API and webhooks, so enterprises can go after leaked secrets that still work first

Public monitoring finds an enterprise's secrets leaked into public repositories. This covers the new handling tools, and why closing an alert isn't remediation.

Primary source GitHub Changelog · github.blog Read the original ↗

// Key points

Enterprises can close alerts in the security dashboard as Dismissed or Fixed with a comment, or reopen them; an activity timeline keeps the audit trail, and alerts filter by repository, committer, secret type, attribution method and state.
Validity checks now run automatically and continuously for supported providers, and alerts show whether a credential is Active, Inactive or Unknown.
A new GET /enterprises/{enterprise}/secret-scanning/public-monitoring-alerts endpoint and an enterprise-level secret_scanning_public_monitoring_alert webhook send real-time notice when a new leak is attributed to the organization.
GitHub stresses that closing an alert only changes its state inside the enterprise: it does not revoke the credential or remove it from the public repository. It is in public preview for GitHub Enterprise Cloud, included in Advanced Security or Secret Protection licenses at no extra cost.

Builder's takeThe LiteLLM poisoning on 10-24 showed how easily credentials leave laptops and CI; the still-valid column is exactly what tells you which key to rotate first. I'd wire this webhook into the existing on-call alerts, require same-day revocation for anything Active, and only let an alert be marked Fixed after the key is revoked.

// Background · from #Coding agents

Full timeline →