Introduction to secret protection

Learn how to configure secret protection to identify secrets and prevent new ones from being committed to your repository.

Welcome

Plain-text credentials accidentally stored in repositories on GitHub are a common target for attackers. In fact, we find well over a million tokens stored on the GitHub platform each year. Let's learn how to prevent that!

Who is this for: Developers, DevOps Engineers, security teams.
What you'll learn: How to identify plain-text credentials in your repository and how to prevent them from being exposed on GitHub in future pushes.
Prerequisites: Basics of git and GitHub functionality. We recommend you complete Introduction to GitHub.
How long: This course takes less than 15 minutes to complete.

In this course, you will:

Enable secret protection
Identify secrets stored in your repository
Enable push protection
Stop secrets from being written to your repository

How to start this exercise

Simply copy the exercise to your account, then give your favorite Octocat (Mona) about 20 seconds to prepare the first lesson, then refresh the page.

Having trouble? 🤷

When copying the exercise, we recommend the following settings:

For owner, choose your personal account or an organization to host the repository.
We recommend creating a public repository, since private repositories will use Actions minutes.

If the exercise isn't ready in 20 seconds, please check the Actions tab.

Check to see if a job is running. Sometimes it simply takes a bit longer.
If the page shows a failed job, please submit an issue. Nice, you found a bug! 🐛

© 2025 GitHub • Code of Conduct • MIT License

License

skills/introduction-to-secret-scanning

ErrorLooks like something went wrong!

About

Topics

Resources

License

Code of conduct

Security policy

Uh oh!

Stars

Watchers

Forks

Uh oh!

Contributors 12

Error
Looks like something went wrong!