GitHub adds triage, validity checks and webhooks to public secret monitoring
GitHub expanded public monitoring on October 23, adding alert management, ongoing credential validity checks, a REST API and enterprise webhooks. The feature remains in public preview for GitHub Enterprise Cloud customers, including those using data residency.
Enterprise administrators and security managers can dismiss, mark fixed or reopen findings in the security dashboard. Comments explaining a decision are optional, not mandatory. The dashboard also offers activity timelines and filters for repository, committer, secret type, attribution method and alert state.
For supported providers, public monitoring checks token validity on an ongoing basis and displays Active, Inactive or Unknown. Those labels help responders prioritize a live credential, but the support qualification matters: the announcement does not say every secret type can be checked.
The REST endpoint GET /enterprises/{enterprise}/secret-scanning/public-monitoring-alerts returns attributed findings with metadata, secret type and exposed locations. The secret_scanning_public_monitoring_alert enterprise webhook can notify incident-response systems when a new leak is attributed to the organization.
Closing an alert changes its tracking state for the enterprise. GitHub explicitly says it does not revoke the exposed credential or remove it from a public repository. Teams still need to perform the actual remediation with the credential provider and address the public exposure.
GitHub says public monitoring is included with GitHub Advanced Security or GitHub Secret Protection licenses at no additional cost. That is a license-specific statement, not a claim that the service is free for every account. The release offers teams managing credentials, including AI service keys, more response plumbing; it does not automatically rotate those keys.