GitHub's free secret scanning alerts service, which notifies users of potential repository leaks, hits general availability, after a December 2022 beta release
Bill Toulas / BleepingComputer :
Context & Ripple Effects
This general-availability release is the detection layer of a security stack GitHub has been assembling piece by piece since its code-scanning rollout in 2020. The December 2022 beta let GitHub tune alert quality before opening the service to everyone at no cost.
The sequencing matters: once leaks can be detected for free, the follow-on moves write themselves — push protection going free for public repositories two months later turned alerts into active blocking, and a year on GitHub shipped Copilot-powered autofix for Advanced Security customers.
First-order effects
- Every repository owner can now be notified of leaked secrets like API keys and access tokens without paying for GitHub Advanced Security, moving credential-leak visibility from an enterprise feature to a platform default.
Second-order effects
- With detection free, GitHub could justify making prevention the next free tier: push protection became free for public repos and later enabled by default, so accidental secret pushes get blocked upstream rather than flagged after the fact.
Third-order effects
- If the pattern holds — detect free, prevent free, then sell remediation — GitHub converts security from a bolt-on product category into a bundled platform feature, pressuring standalone secret-scanning vendors and pulling fixes into Copilot-driven workflows.
The trend: Developer platforms are absorbing the entire secret-leak defense chain — detection, blocking, disclosure, and automated remediation — as bundled defaults rather than paid add-ons.