GitHub Secret Scanning Adds New Secrets and Extended Metadata
GitHub has expanded secret scanning with default push protection for new secret types from APIclub, Mistral AI, PostHog, and Resend, and added a new partner, Lovable Labs. This enhancement helps prevent accidental exposure of sensitive credentials in repositories. Additionally, alerts now include richer metadata for certain secrets from providers like Cohere, GoCardless, and Square, enabling faster assessment of ownership and impact. These updates are available for repositories with secret scanning enabled, including free public repositories.
- →New secret types supported by push protection
- →Lovable Labs added as secret scanning partner
- →Extended metadata for secret scanning alerts
- →Information on secret scanning partner program and extended metadata
Features (2) ›
- New secret types supported by push protection
Secret scanning now includes default push protection for APIclub's apiclub_api_key, Mistral AI's mistral_ai_api_key, PostHog's posthog_oauth_access_token, and Resend's resend_api_key. This blocks commits containing these secrets by default in repositories with secret scanning enabled.
- Lovable Labs added as secret scanning partner
Lovable Labs is now a GitHub secret scanning partner. The system will automatically detect and report lovable_api_key secrets found in public repositories to Lovable Labs for appropriate action.
Enhancements (1) ›
- Extended metadata for secret scanning alerts
Secret scanning alerts now include richer metadata when available from the provider, such as the secret's owner, creation/expiry dates, and associated project. This provides context for assessing ownership and impact directly from the alert for specific patterns including Cohere, GoCardless, and Square secrets.
Notes (1) ›
- Information on secret scanning partner program and extended metadata
GitHub provides further documentation on the secret scanning partner program, how to review extended metadata on alerts, and a comprehensive list of supported secrets.
https://github.blog/changelog/2026-08-07-secret-scanning-coverage-updates
Related releases
- GitHub Copilot introduces Agent Plugins 1.0 for cross-client development GitHub Changelog ·
- GitHub Details Organization-Level Repository Rule Insights GitHub Changelog ·
- GitHub Enterprise Server 3.22 Release Candidate Now Available GitHub Changelog ·
- GitHub Copilot for JetBrains adds persistent memory, Ollama integration, and enterprise controls GitHub Changelog ·
- Automatically Migrate Branch Protection Rules to Repository Rulesets GitHub Changelog ·
- GitHub Copilot's MAI-Code-1-Flash model slated for deprecation GitHub Changelog ·