GitHub expanded its secret scanning coverage in the August 7 changelog update, adding new detectors to push protection defaults and introducing extended metadata for alerts. The update also brings Lovable Labs into the secret scanning partner program, giving developers more tools to prevent credential leaks before they reach public repositories.
Push protection now blocks a broader set of secret types by default in repositories with secret scanning enabled. This includes free public repositories, which receive automatic push protection without requiring paid plans. GitHub Changelog
The extended metadata feature builds on GitHub’s existing validity checks. When information is available from the provider, alerts now surface the secret’s owner, creation and expiry dates, and the associated project or organization. This context helps developers assess ownership and impact without leaving the alert interface. GitHub Changelog
Lovable Labs joined as a secret scanning partner. When a Lovable Labs secret is found in a public repository, GitHub forwards it to Lovable Labs for appropriate action. GitHub Changelog
Secret scanning runs by default on public repositories and public npm packages, scanning the entire Git history across all branches for hardcoded credentials. The system also monitors issue descriptions, pull request titles and descriptions, discussions, wikis, and secret gists. GitHub Docs
For teams using GitHub’s enterprise features alongside open-source projects, the expanded coverage aligns with broader platform security investments. Enterprises can now install third-party GitHub Apps with tighter controls, making the ecosystem more governable alongside native security tools. For open-source maintainers, the push protection default means fewer accidental credential commits in community projects without configuration overhead.
The metadata availability varies by provider, token type, and individual secret, with GitHub making a best effort to display it when present. GitHub Changelog
For teams relying on GitHub’s security tooling, the expanded push protection and richer alert context give developers more immediate visibility into exposed credentials. GitHub Changelog
