GitHub boosts secrets scanning: A necessary step, but supply chain security is key to managing risk

The report examines the risk of leaked development secrets in software supply chains and assesses GitHub’s enhanced secrets scanning and token validity checks, now extended to select tokens for AWS, Microsoft, Google, and Slack. Experts note benefits for remediation efficiency and prioritization while warning about alert fatigue and false positives. It concludes that organizations need a holistic, zero-trust-oriented approach to secrets management across repositories, CI/CD pipelines, containers, and cloud services, with prioritization of the most critical secrets.