Secret Scanning Alerts should ignore known public "secrets" #142874
Replies: 1 comment
-
💬 Your Product Feedback Has Been Submitted 🎉 Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users. Here's what you can expect moving forward ⏩
Where to look to see what's shipping 👀
What you can do in the meantime 💻
As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities. Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐ |
Beta Was this translation helpful? Give feedback.
-
Select Topic Area
Product Feedback
Body
I've been remediating repositories, and have run into a few instances where the scanner is flagging "secrets" that are actually part of documentation, such as https://docs.stripe.com/payments/payment-intents (which contains the key
sk_test_4eC39HqLyjWDarjtT1zdp7dc
).The key is active, but intentionally so, and in my case the developer who committed it to the repository I'm remediating used the code as a boilerplate to build his code off of.
Keys such as this should be excluded from alerts.
Beta Was this translation helpful? Give feedback.
All reactions