Secret scanning
Secret scanning is an automated check, run by tools like GitHub's built-in scanner or standalone tools such as gitleaks, that searches a codebase and its commit history for patterns matching known secret formats, such as an API key prefix, and flags or blocks them.
Why it matters
Many providers, including Anthropic and most major cloud platforms, partner with GitHub's secret scanning so a key matching their known format is automatically flagged, and in some cases automatically revoked, the moment it is pushed publicly.
Does secret scanning stop a leak from happening?
It can catch it very quickly after the fact, and some setups block the push entirely, but the value should still be treated as compromised once it is flagged.
Do I need to set up secret scanning myself?
Many git hosting platforms enable a baseline version by default, though dedicated tools offer more thorough coverage.
Related
Looking for a different way to manage your keys? See the best Claude Code API key manager alternatives, or browse every term in the glossary.