cyber.hendryadrian.com
Security News · stepsecurity.io

GitHub Expands Enterprise Secret Scanning to Public Content, but Gaps Remain

· Original article ↗

Summary

GitHub’s enterprise public monitoring scans public git content, pull request comments and issues for organizational secrets, but not private repositories or documented workflow logs. The article recommends pairing alerts with CI egress controls.

Key points

  • GitHub says public monitoring scans public git content, pull request comments and issues in real time, and attributes matches to enterprises using its identity layer and verified domains.
  • The feature is in public preview for GitHub Enterprise Cloud customers with Secret Protection or Advanced Security, at no additional cost.
  • Private repositories are not scanned; the feature detects secrets already exposed on the announced public surfaces rather than preventing initial exposure.
  • The article notes that exfiltration to attacker-controlled infrastructure and workflow run logs are outside the feature’s documented coverage.
  • The author recommends enabling monitoring, triaging alerts and rotating active secrets, while using runtime egress controls to block unexpected outbound traffic from GitHub Actions.
  • The article cites Sha1-Hulud, Megalodon, TeamPCP, GhostAction and the tj-actions/changed-files compromise as examples of secret-exposure paths.

Article Details

Event Type
GitHub introduced public-preview secret scanning for enterprises, monitoring public content on github.com for organizational secrets.
Impact
The feature scans public Git content, pull request comments, and issues in real time, and attributes detected secrets to an enterprise using GitHub's identity layer and verified domains. It detects secrets only after they are publicly exposed and does not scan private repositories or, according to the article, workflow run logs. The article says it does not prevent exfiltration through other destinations or stop attackers from using exposed credentials. It reports that the Sha1-Hulud: The Second Coming worm deposited credentials in more than 21,000 public repositories and that Megalodon exfiltrated secrets across 5,500 public repositories.

MITRE ATT&CK

T1567.001 · Exfiltration to Code RepositoryThe article describes Sha1-Hulud: The Second Coming exfiltrating stolen credentials as JSON blobs into public GitHub repositories.

Threat Actors

TeamPCPThe article attributes campaigns to TeamPCP that compromised Trivy and hid a credential stealer in the telnyx PyPI package.

Malware

Sha1-Hulud: The Second Cominghave learned that github.com itself makes an excellent exfiltration destination. When Sha1-Hulud: The Second Coming hit the npm ecosystem in November 2025, the worm exfiltrated stolen credentials as JSON blobs

Vendors

GitHubGitHub's new public monitoring finds your enterprise's leaked secrets anywhere on github.com. Here is what it covers, what it cannot see, and how to close the exfiltration gap.  StepSecurityStepSecurity also covers the adjacent leak paths inside your own pipelines: detecting leaked secrets in workflow artifacts and build logs, both places where secrets are exposed long before they ever reach a public

Products

Advanced Securityis available at no additional cost for GitHub Enterprise Cloud customers with Secret Protection or Advanced Security. Enterprise owners and enterprise security managers can enable it from the enterprise Security tab,GitHubGitHub's new public monitoring finds your enterprise's leaked secrets anywhere on github.com. Here is what it covers, what it cannot see, and how to close the exfiltration gap.  GitHub ActionsThis is what runtime egress control does. Harden-Runner monitors outbound network calls from GitHub Actions workflow runs and, in block mode, only allows traffic to endpoints you have explicitly allowed. Whether aGitHub Enterprise CloudThe feature is available at no additional cost for GitHub Enterprise Cloud customers with Secret Protection or Advanced Security. Enterprise owners and enterprise security managers can enable it from the enterpriseSecret ProtectionThe feature is available at no additional cost for GitHub Enterprise Cloud customers with Secret Protection or Advanced Security. Enterprise owners and enterprise security managers can enable it from the enterprise

Tools

Action AdvisorAudit your GitHub Actions workflows for exfiltration exposure. You can analyze any public repository's workflows with Action Advisor, free and with no login.StepSecurity Harden-RunnerThis is what runtime egress control does. Harden-Runner monitors outbound network calls from GitHub Actions workflow runs and, in block mode, only allows traffic to endpoints you have explicitly allowed. Whether a

Related Articles