GitHub now scans Actions logs for leaked secrets

Your CI logs are a place where secrets leak, and GitHub just started looking there. On November 9, GitHub said secret scanning now detects secrets in GitHub Actions workflow logs. It's a public preview, and the fine print limits who gets it. Most small teams won't get it at all, so the habit matters more than the feature.

What actually happened

From GitHub's changelog:

• What's new. When a workflow run completes, GitHub scans its logs for provider secret patterns. Findings land in the repo's secret scanning alert list with a link back to the log.
• Who gets it. Enterprises on GitHub Enterprise Cloud with GitHub Secret Protection or GitHub Advanced Security, including data residency on GHE.com.
• Off by default. An enterprise owner turns it on under Policies → Advanced Security → "Secret scanning for Actions workflow logs."
• No backfill. Only runs that complete after you enable it are scanned. Old logs aren't checked.
• No notifications. During the preview, alerts from Actions logs don't send notifications. You have to look at the alert list.
• What it misses. Generic patterns, custom patterns, AI-detected secrets, and secrets Actions already masked.

Two good details: validity checks run for supported secret types, and alerts stay after the logs are deleted.

Why it matters for your business

A secret in a log is as public as the log. Anyone with read access to the repo can usually read its Actions logs, and on a public repo that's everyone. The usual leaks are boring: a debug echo, a verbose CLI flag, a test that prints a full config, or an error message that dumps a connection string.

If you're on Enterprise Cloud with the right license, turn this on and put a weekly check of the alert list on someone's calendar, since nothing will notify you yet. If you're on Free or Team, which is most small shops, you don't get this. Do it by hand:

1. Put every secret in Actions secrets. Actions masks registered secrets in logs. A key you paste into a workflow file or build from parts doesn't get masked.
2. Kill debug output. Search your workflows for echo, env, printenv, set -x and --verbose.
3. Check old logs yourself. No backfill means old leaks stay. Skim recent runs or delete logs you don't need.
4. Rotate on any doubt. If a live key showed up in a log, revoke it first. Read the logs after.
5. Use short-lived credentials. OIDC to your cloud beats a long-lived key in a secret.

Sources: GitHub Changelog, GitHub Docs.