GitHub adds triage, validity checks, API and webhooks to public monitoring

Alert triage and activity history

GitHub's announcement says enterprise administrators and enterprise security managers can now triage public-monitoring findings directly in the enterprise security dashboard. Responders can close an alert as Dismissed or Fixed, add an optional comment and reopen it later. An activity timeline records actions and state changes.

GitHub also lists filters for repository, committer, secret type, attribution method—how it links a leaked secret to an enterprise—and alert state.

Closing an alert changes its enterprise-level state, GitHub says. It does not revoke the credential or remove the exposed material from the public repository. Marking a finding Fixed is an administrative action; disabling the credential requires action elsewhere.

Validity checks and integration tools

GitHub says public monitoring now checks credential validity automatically on an ongoing basis for supported providers. Alerts display Active, Inactive or Unknown, adding a credential-status signal alongside the finding's location and attribution.

For teams connecting findings to their own incident-response systems, the announcement introduces a REST API endpoint—a programmatic interface for retrieving records. Enterprise administrators and enterprise security managers can query attributed findings, including alert metadata, secret type, attribution and exposed locations. An enterprise-level webhook, which sends an event notification to a configured system, provides notifications when a newly detected leak is attributed to the organization.

Coverage, licensing and eligibility

GitHub's documentation describes public monitoring as an extension beyond secret scanning in enterprise-owned repositories. Its scope includes public GitHub.com repositories owned by others and non-code content such as issue and pull-request comments. A July DEV Community article also described that broader coverage.

The documentation says GitHub attributes findings through enterprise membership and verified-domain matching. Domain matching can connect a leak to an enterprise even when the user is not a direct enterprise member; both attribution methods operate when monitoring is enabled.

Public monitoring is included with a GitHub Advanced Security or GitHub Secret Protection license at no additional cost, according to the announcement and the July DEV article. The documentation requires one of those licenses to be enabled. Enterprise administrators and enterprise security managers enable monitoring and manage alert settings in the enterprise security dashboard, the announcement says.

GitHub's announcement includes a category of Enterprise Cloud customers that its documentation explicitly excludes. Those customers face conflicting official statements about whether they can use public monitoring.

Not yet confirmed

• Eligibility for the Enterprise Cloud customer category included in the announcement but excluded in the documentation remains unresolved. The documentation's publication date is unavailable, so its timing relative to the announcement is unclear.
• Supported validity-check providers and secret types, check frequency, latency guarantees, API authentication scopes and operational limits, and webhook retry and delivery guarantees are unspecified.
• The earlier preview's alert-management, validity-check, API and webhook behavior is not documented; descriptions of these capabilities as new rest on GitHub's announcement.
• A phased rollout schedule and completion date for the additions are not confirmed.
• The October additions lack independent corroboration. The sole outside source, a DEV Community article, covers the earlier preview rather than this update.

What to watch

• GitHub reconciliation of customer eligibility across its announcement and documentation.
• Publication of provider coverage and operational details for validity checks, the API and webhooks.

Related coverage

• AIGitHub secret scanning adds detectors for Lovable, Supabase and Pydantic tokens
• AIGitHub makes agentic autofix generally available for code scanning alerts
• AIGitHub Actions retires macOS 14 runners on November 2, with brownouts through October 30