Secret-Scanning · CuraDevOps

tag: Secret-Scanning · 11 items

Platform/SRE — Skip
CI/CD — Plan: New GA capabilities in GitHub secret scanning—validity checks, dismissals, API, and webhooks—are worth integrating this quarter to automate triage and response when pipeline credentials or tokens are exposed in public repos.
Leader — Learn: GitHub’s expanded secret-monitoring surface (validity checks, webhooks, API) shapes how orgs can build automated security workflows around leaked credentials, but no licensing, pricing, or vendor-risk decision is triggered.

Platform/SRE — Skip
CI/CD — Learn: Public preview feature extending secret scanning to public repos for GHEC DR customers; worth monitoring for GA, but no pipeline action needed today.
Leader — Learn: If your org uses GHEC with data residency, this expands secret scanning coverage to public repositories; track for GA adoption as a security policy enhancement.

Platform/SRE — Skip
CI/CD — Act: The business field in secret_scanning_alert.* and secret_scanning_push_protection.bypass audit log events changes on November 12, 2026; audit any automation, SIEM integrations, or compliance scripts that parse these events and update field references before that date.
Leader — Skip

Platform/SRE — Skip
CI/CD — Plan: Verify your repositories have push protection enabled and audit any existing Anthropic API keys or Salesforce credentials in build logs or secrets; no deadline but this is a worthwhile supply-chain hardening step to schedule.
Leader — Skip

Platform/SRE — Learn: Improved secret detection in GitHub repositories is a useful security capability, but it has no operational change or deadline for infrastructure teams to act on.
CI/CD — Plan: Evaluate enabling the new context-aware secret scanning model in GitHub Advanced Security to strengthen supply-chain hygiene; no hard deadline, but worth scheduling as part of a supply-chain hardening quarter.
Leader — Learn: GitHub’s investment in AI-driven secret detection signals maturing supply-chain security tooling, worth factoring into security posture reviews, but no pricing, licensing, or strategic decision is triggered.

Platform/SRE — Skip
CI/CD — Learn: If your pipelines or repos use Supabase or Lovable credentials, GitHub will now automatically flag exposed tokens — no pipeline changes required, but worth knowing so teams understand why new alerts may surface.
Leader — Skip

Platform/SRE — Skip
CI/CD — Plan: New GA GitHub capability lets teams enforce secret-blocking via repository rulesets; schedule a rollout to enable this across all repos as a supply-chain hardening step this quarter.
Leader — Plan: This is a concrete org-wide policy lever — evaluate mandating the new secret-blocking ruleset as a standard across all GitHub repositories to reduce credential-leak risk at the merge gate.

Platform/SRE — Skip
CI/CD — Learn: GitHub expanded push protection to block additional secret types and added a new scanning partner; worth reviewing if your pipelines commit credentials that may now be flagged before merge.
Leader — Skip

Platform/SRE — Skip
CI/CD — Plan: New secret types are now auto-detected in repo scans; review your secret scanning policy to ensure newly covered credential types (Resend, APIclub) are included in alerting and rotation workflows.
Leader — Skip

Platform/SRE — Skip
CI/CD — Plan: New GA endpoints let teams manage secret scanning custom patterns as code, enabling IaC-style enforcement of scanning policies across repos; schedule adoption as part of supply-chain hardening this quarter.
Leader — Skip
Signals: GA announcement

Platform/SRE — Skip
CI/CD — Learn: If your pipelines parse or display GitHub secret scanning output, the renamed detector type labels may affect dashboards or tooling that filters by those names — low urgency, no deadline.
Leader — Skip