Documentation
Book a demo

Supply chain security

GitHub secret scanning

When credentials like API keys are committed to repositories as hardcoded secrets, they become targets for unauthorized access. GitHub secret scanning automatically detects credential leaks so that you can secure them before they're exploited.

Cloudsmith is a member of the GitHub secret scanning partner program. This means that Cloudsmith-issued API keys are uniquely identifiable, and GitHub can detect them automatically when they appear in a repository.

See the GitHub documentation for more information about secret scanning and supported secret scanning patterns.

How it works

Cloudsmith issues API keys with a unique prefix. That prefix is registered with GitHub's secret scanning infrastructure, so if a Cloudsmith API key appears in a repository, GitHub detects and flags it automatically.

If an API key is leaked:

  1. GitHub detects the leaked credential and notifies Cloudsmith via a registered webhook.

  2. Cloudsmith notifies the affected user and workspace owners via email, so that they can rotate the key immediately.

    The email includes every location on GitHub where the key was found, with a direct link to each. Cloudsmith reports exposures in the following locations:

    • File contents
    • Commits
    • Issue titles, descriptions, and comments
    • Pull request titles, descriptions, comments, reviews, and review comments
    • Discussion titles, bodies, and comments
    • Wiki commits

  3. Cloudsmith records an API_KEY_EXPOSED event in the workspace audit log, including the masked key and the location where it was detected.

For information about refreshing your personal Cloudsmith API key, see Refreshing a Personal/User API Key.

Note

Secret scanning runs automatically on public repositories for free. For information about GitHub secret scanning for private repositories, see GitHub Docs: Secret scanning - How can I access this feature?.