GitHub Adds Triage and Webhooks to Its Public Secret Monitoring

On October 23, 2026, GitHub added three capabilities to public monitoring, a secret-leak detector reserved for Enterprise Cloud customers: alert triage, automatic validity checks for exposed tokens, and a REST API with webhooks. The stated goal is to turn a simple detection feed into a full operational surface for security teams.

#A feature launched in July, extended in October

Public monitoring has existed since July 1, 2026. It continuously scans public GitHub.com repositories, including issue and pull request comments, for tokens belonging to a customer enterprise. Two attribution methods are combined: account membership in the enterprise, and a match with one of the enterprise’s verified email domains, even for an account that isn’t a member. On October 22, the preview was extended to Enterprise Cloud tenants with data residency. The next day, GitHub added triage, validity checks, the API, and webhooks, all at no extra cost for enterprises with GitHub Advanced Security or GitHub Secret Protection.

#Triaging alerts without mistaking closure for remediation

From the enterprise security dashboard, an alert can now be marked “Dismissed” or “Fixed”, with an optional comment, and reopened later if needed. A timeline logs every state change, and alerts can be filtered by repository, committer, secret type, attribution method, or state.

Closing an alert in the enterprise dashboard neither revokes the secret nor removes it from the public repository: it is an administrative update, not a remediation.

For teams fielding dozens of alerts a week, that distinction matters: triage organizes the team’s workload, it doesn’t neutralize the leak itself.

#Validity checks: separating noise from urgency

For supported providers, GitHub now periodically checks whether an exposed token still responds. Every alert gets one of three states:

#REST API and webhooks: wiring alerts into existing tooling

The GET /enterprises/{enterprise}/secret-scanning/public-monitoring-alerts endpoint returns each alert’s metadata: secret type, attribution method, and exposure location. It’s available to enterprise admins and enterprise security managers.

curl -s -H "Authorization: Bearer $GH_TOKEN" \
  -H "Accept: application/vnd.github+json" \
  https://api.github.com/enterprises/ACME-CORP/secret-scanning/public-monitoring-alerts

On the notification side, the enterprise webhook event secret_scanning_public_monitoring_alert fires near real time whenever a new leak is attributed to the organization, routing it to a SIEM or an on-call channel without polling the API in a loop.

#Who can use it, and at what cost

The feature remains a public preview, limited to GitHub Enterprise Cloud, including data residency. It is included at no extra cost with GitHub Advanced Security or GitHub Secret Protection, and enabling it and managing alert settings is the job of enterprise admins and enterprise security managers.

#Key takeaways

Public monitoring moves from a simple detection feed to a full working surface: triage, validity-based prioritization, an API, and webhooks. It still remains confined to large Enterprise Cloud organizations, in preview, and doesn’t replace the basic reflexes already covered by earlier secret-scanning expansions — Anthropic and Salesforce keys or Lovable and Supabase keys: rotating tokens fast and purging the exposed Git history.

Further reading: GitHub’s official changelog announcement.