Secret scanning on every pull request

A key pasted into a config file is the security bug you can find without a model. The security review now does that first, on every commit it reviews.

• Fixed patterns, every added line GitHub shows. AWS access keys and secret keys, private keys, GitHub, GitLab, Slack, Stripe live, OpenAI, Anthropic, Google, SendGrid, npm and PyPI tokens, Slack webhook URLs, database and queue connection strings with a password, and random-looking values assigned to names like secret, token or api_key. Generated and vendored files the model skips, and files past the review's size cap, are checked too. Lockfiles, binaries, files GitHub sends without a diff (it leaves out the diff of a very large file) and files after the first 300 are not.
• A finding on the line. Each match is a secrets finding on the file and line the pull request adds, with the provider and how to rotate it: critical for a live credential or a private key, high for connection strings, Google keys, webhooks and secret-named values. Up to 30 matches are listed per commit, with a count of the rest, and they are reported even when the model review fails.
• Never the value. The check, its annotations and the comment show the line with only the key's public prefix, such as AKIA…[redacted], and nothing of a password. Every value the patterns recognise is masked in the diff before it goes to the model, on added, removed and unchanged lines.
• Fewer false alarms. A match in a test, mock, fixture or example file (such as .env.example) is rated low, as are documented example keys and connection strings to localhost. Placeholders like ${DB_PASSWORD}, <token> or your_api_key are not reported, and neither are URLs, routes, header names, version strings, regular expressions or Stripe publishable and test keys held in secret-named variables.

It runs inside the security review, on Pro and Team, for repositories with Security review turned on in Connections, GitHub. A secret goes through the repository's merge gate like any other finding: at the gate's severity (High by default) or above it fails the check, which blocks merging once the check is required in a branch ruleset. Secret scanning has its own page.