Skip to main content

GitHub Secret Scanning - User Guide

In this article, you will understand step by step how to integrate Scytale with GitHub Secret Scanning

GitHub Secret Scanning detects hardcoded credentials - such as API keys, tokens, and passwords - committed across a repository's Git history, and raises alerts so they can be rotated.

Required Permissions

  • read: organization/administration

  • read: repository/metadata

Scytale follows the least-privilege principle, limiting permission scopes strictly to what's required for reliable audit evidence collection.

How to Connect

  1. In Scytale, go to 'Integrations'.

  2. Search for GitHub Secret Scanning and select 'Connect'.

  3. You will be redirected to GitHub to install the Scytale Secret Scanning app.

    Note: You must have the owner or admin role on your GitHub organization in order to install the app.

  4. Select the organization you want to monitor, choose the repositories to include, and approve the requested permissions.

  5. Add a connection name — this will be used to differentiate between your connections — and then select 'Connect'.

You have now successfully connected to GitHub Secret Scanning.

Related Articles
Did this answer your question?