Build radar
Oct 24Vercel AI SDK @ai-sdk/zai@3.0.40Oct 23Claude Code v2.1.310Oct 25MoonshotAI: Kimi K3.1 Pro · OpenRouterOct 25AI News: A new AI model with a huge memory is ready to try today
Sources 33Updates always the freshest
PLEN
0 Newsletter
Animated illustration for: Did your company’s key leak into public code? GitHub aims to tell you
AI News · Oct 25, 2026 · 1 min

Did your company’s key leak into public code? GitHub aims to tell you

A leaked key in public code is one of the most dangerous slips. I explain how GitHub aims to help companies catch them, check if the key still works and react.

Przemek z plecakiem na skalnym szlaku nad fiordemPrzemysław FilipiakAI Product Engineer & Content Creator
Published · As of Oct 25, 2026
In short
  • GitHub expanded public monitoring with alert management, always-on validity checks, an API and webhooks.
  • The feature is in public preview for Enterprise Cloud customers.
  • Closing an alert does not revoke the key.

The short version: GitHub expanded ‘public monitoring’, which detects leaked secrets in public repositories that can be attributed to a company. According to the announcement it now has alert management, always-on token validity checks, a REST API and webhooks.

What changed

  • Alerts can be closed as ‘Dismissed’ or ‘Fixed’ with a comment and reopened; there is also an activity timeline.
  • You filter alerts by repository, committer, secret type, attribution method and state.
  • Token validity is checked continuously for supported providers: Active, Inactive or Unknown.
  • There is a REST endpoint GET /enterprises/{enterprise}/secret-scanning/public-monitoring-alerts and a webhook event secret_scanning_public_monitoring_alert.

Who can use it

The feature is in public preview for GitHub Enterprise Cloud customers, including data residency. According to the post it is included with a GitHub Advanced Security or Secret Protection license at no extra cost. Enterprise admins and security managers manage it.

How to read this

GitHub notes that closing an alert only changes its state for the enterprise: the key is not revoked and the secret is not removed from the public repository. The post lists neither supported providers nor check frequency. I write more about risks in AI-written code in the hub on AI code security.

Sources

Public monitoring adds triage, validity, API, and webhooksGitHub · Oct 25, 2026 · Primary sourceGitHub ChangelogGitHub · Oct 25, 2026
AI code security

Related

AI NewsOct 24Your AI agent no longer needs the master key to Stripe

AI agents often get a key that can do anything on your payment account. I explain how Vercel gives each agent only the permissions its job needs.

AI NewsOct 22A leaked GitHub login can now stop working within hours

If you sign in to GitHub from your terminal, a stolen key can now die in hours instead of living forever. I show how to switch it on and what to watch for.

AI NewsOct 21GitHub wants to stop malicious packages before they reach your code

GitHub is testing a gate that stops suspicious packages of other people's code before they reach your project. I explain how it works and who can use it.