GitHub Secret Scanning Public Monitoring for Enterprises: Coverage and Gaps

What it is

GitHub's public monitoring for secret scanning, shipped July 1 (2025) and in public preview for enterprises. It scans public content across all of github.com in real time — git content, PR comments, and issues — and attributes matches back to your enterprise via GitHub's identity layer and verified domains rather than commit-email guessing. The post is a StepSecurity analysis of its coverage boundary, and pitches Harden-Runner as the prevention layer.

Preconditions / Affected

• GitHub Enterprise Cloud with Secret Protection or Advanced Security — no additional cost.
• Enabled by enterprise owners or enterprise security managers from the enterprise Security tab.
• Private repos are never scanned; only already-public exposure surfaces. Enterprise Cloud with data residency is not yet supported.

What it does not see

• Off-github.com exfiltration — theft to attacker-owned infrastructure (cited: TeamPCP against Trivy and the telnyx PyPI package; GhostAction, which stole 3,000+ secrets via malicious workflows posting to attacker endpoints).
• Workflow run logs — absent from both the announcement's scan list and GitHub's secret-scanning docs (which cover commits, issues, PRs, discussions, gists). The tj-actions/changed-files compromise exposed CI credentials in build logs. Treat log-based exposure as out of scope until GitHub documents it.
• It is detection after exposure. Attackers validate and abuse dumped credentials within minutes; real-time detection shrinks the response window but does not reopen the one already closed.

What to do

The page's concrete checklist:

• Enable public monitoring from the enterprise Security tab; triage the recently-leaked secrets it surfaces and rotate anything active.
• Audit GitHub Actions workflows for exfiltration exposure. Action Advisor analyzes any public repo's workflows, free and no login.
• Run a GitHub Actions security audit for full CI/CD risk.
• Add runtime egress control (Harden-Runner) so the next exfiltration attempt fails at the network layer — in block mode it allows only explicitly-allowlisted outbound endpoints and surfaces anomalous calls at the moment they happen.

Context worth knowing

The named motivating incidents: Sha1-Hulud: The Second Coming (Nov 2025) dumped stolen credentials as JSON into 21,000+ UUID-named public repos within hours; Megalodon used 5,500 public repos. Harden-Runner reportedly caught Sha1-Hulud in practice via baseline anomaly detection in CNCF's Backstage repo.

Caveats

This is a vendor post — the "close the gap" conclusion routes to StepSecurity's own product. The coverage/gap analysis is grounded in GitHub's own documentation, but the workflow-log gap is inferred from documentation absence ("until GitHub documents log coverage"), not a stated exclusion.