GitHub Announces Important Updates and Bug Fixes for Secret Scanning
The latest updates to GitHub secret scanning bring important changes to audit log events, automated revocation actions for encoded tokens, webhook payloads, and several bug fixes designed to improve stability and accessibility.
Radwan AbdulhadiEditor and technology writer
Audit Log Event Updates and Workflow Preparations
GitHub has announced an upcoming change affecting specific audit log events related to secret scanning. Scheduled for rollout on November 12, 2026, the business field in affected secret_scanning_alert.* and secret_scanning_push_protection.bypass audit log events will transition from using the enterprise display name to utilizing the enterprise slug instead.
To prevent any potential disruption to automated workflows, developers and administrators are advised to update their integrations that filter by display name. Integrations should be adjusted prior to the rollout to accept both formats or switch to utilizing business_id instead. GitHub notes that while the format of the value changes, the business field remains a string, and event names alongside numeric business_id values will stay unchanged. More technical documentation can be found via enterprise audit log events.
Improvements to Custom Patterns and Token Revocation
Additional improvements focus on custom pattern alerts and token revocation capabilities. When a rescan determines that existing open alerts still match an edited custom pattern, those alerts will now stay open rather than going through a cycle of being closed and then reopened.
Furthermore, for private and internal repositories hosted on github.com with secret scanning enabled, the public preview revocation action now extends support to encoded personal access tokens (classic), fine-grained personal access tokens, OAuth access tokens, and GitHub App user access tokens. The platform handles these automatically by decoding the provided value.
Webhooks, Accessibility, and API Response Enhancements
Dismissal-request webhooks have been updated so that incoming payloads now incorporate exemption_request.number. This repository-scoped request number is also accessible via the secret scanning REST API. Developers can combine the repository identifier with the request number to correlate requests across various integrations seamlessly.
Accessibility improvements are also part of this release cycle. The Request pending status on a given alert is now fully keyboard-focusable without accidentally triggering an action. Additionally, the revocation flow now actively announces progress updates to screen readers and redirects user focus straight to its completion panel as soon as that panel appears on the screen.
Bug Fixes and Error Code Adjustments
Several targeted bug fixes address reported issues with bypass-request metadata and delegated bypass configurations. A previous issue causing empty secret-type and location details in bypass-request API responses and webhook payloads—specifically occurring during command-line pushes when another repository rule ran after secret scanning—has been successfully resolved.
In addition, fixes were deployed for delegated bypass features, correcting push failures that stemmed from pre-existing organization-role entries inside reviewer lists. The update also resolves 500 errors that previously occurred when users attempted to configure valid reviewer setups for organization-owned repositories through the REST API. Finally, the custom pattern API has been updated so that requests rejected by the scanning service due to invalid arguments now return a 422 status code instead of a 500 error, allowing integrations to cleanly differentiate between input errors and underlying server failures.
Sources
- GitHub ChangelogUpdates to GitHub secret scanning
Continue chronologically
Related entity coverage
Related stories
GitHub Announces Major App Improvements for Least Privilege
GitHub releases new updates for GitHub Apps to improve least privilege access, streamline repository management, and help developers transition from classic PATs.
GitHub Updates Usage Metrics API with Custom Skills and MCP Servers
GitHub updates the Copilot usage metrics API to display specific names for custom skills, agents, MCP servers, slash commands, and plugins.
GitHub Launches Private Saved Views and Relates To API Support
GitHub introduces private saved views for repository issues and extends the 'Relates to' relationship across APIs, webhooks, and search for better issue management.
Public Monitoring Adds Triage, Validity, API, and Webhooks
GitHub Enterprise Cloud adds new alert management capabilities to public monitoring, featuring automatic validity checks, REST APIs, and webhooks.
