# Secret Scanning

Secret scanning is a security technology that automatically detects exposed credentials, including API keys, passwords, and tokens, in code repositories and Git history.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## How to Catch Security Vulnerabilities in Code Before They Reach Your Pull Requests

DevFeed: [How to Catch Security Vulnerabilities in Code Before They Reach Your Pull Requests](<https://devfeed.tech/articles/how-to-catch-security-vulnerabilities-in-code-before-they-reach-your-pull-requests-20761.md>)

Original publisher: [Read original article](<https://www.freecodecamp.org/news/catch-security-vulnerabilities-code-pull-requests/>)

Author: Umair Mirza

Published: 2026-09-14T22:23:01Z

Content type: tutorial

Language: en

Sources: [freeCodeCamp Programming Tutorials: Python, JavaScript, Git & More](<https://devfeed.tech/sources/freecodecamp-programming-tutorials-python-javascript-git-more.md>)

Topics: [Application Security](<https://devfeed.tech/topics/application-security.md>), [Security](<https://devfeed.tech/topics/security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Secret Scanning](<https://devfeed.tech/topics/secret-scanning.md>), [Git](<https://devfeed.tech/topics/git.md>), [pull-requests](<https://devfeed.tech/topics/pull-requests.md>), [ci](<https://devfeed.tech/topics/ci.md>), [Command-line interface](<https://devfeed.tech/topics/cli.md>), [.NET](<https://devfeed.tech/topics/net.md>), [Python](<https://devfeed.tech/topics/python.md>), [coding](<https://devfeed.tech/topics/coding.md>)

Tags: [application-security](<https://devfeed.tech/tags/application-security.md>), [ci](<https://devfeed.tech/tags/ci.md>), [cli](<https://devfeed.tech/tags/cli.md>), [code](<https://devfeed.tech/tags/code.md>), [devsecops](<https://devfeed.tech/tags/devsecops.md>), [git](<https://devfeed.tech/tags/git.md>), [net](<https://devfeed.tech/tags/net.md>), [pull-requests](<https://devfeed.tech/tags/pull-requests.md>), [python](<https://devfeed.tech/tags/python.md>), [sast](<https://devfeed.tech/tags/sast.md>), [secret-scanning](<https://devfeed.tech/tags/secret-scanning.md>), [security](<https://devfeed.tech/tags/security.md>), [security-vulnerabilities](<https://devfeed.tech/tags/security-vulnerabilities.md>), [software-development](<https://devfeed.tech/tags/software-development.md>), [testing](<https://devfeed.tech/tags/testing.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

### AI overview

This tutorial explains how to shift security checks earlier in development by running SAST locally with Git pre-commit hooks. It demonstrates using the DevSkim CLI to detect insecure coding patterns, pairing it with Gitleaks for dedicated secret scanning, validating the setup with an intentional failure, and enforcing the checks in CI.

### Source excerpt

Security reviews are most effective when developers receive feedback while the code is still fresh in their minds. Waiting until a pull request, CI build, or penetration test to find exposed credentia

## How to evaluate LLMs before production

DevFeed: [How to evaluate LLMs before production](<https://devfeed.tech/articles/how-to-evaluate-llms-before-production-82.md>)

Original publisher: [Read original article](<https://github.blog/ai-and-ml/llms/how-to-evaluate-llms-before-production/>)

Author: Mariko Wakabayashi

Published: 2026-08-25T21:35:11Z

Content type: article

Language: en

Sources: [GitHub Engineering](<https://devfeed.tech/sources/github-engineering.md>)

Topics: [Large Language Model](<https://devfeed.tech/topics/llm.md>), [Secret Scanning](<https://devfeed.tech/topics/secret-scanning.md>), [Benchmark](<https://devfeed.tech/topics/benchmark.md>), [datasets](<https://devfeed.tech/topics/datasets.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [Security](<https://devfeed.tech/topics/security.md>)

Tags: [ai-ml](<https://devfeed.tech/tags/ai-ml.md>), [benchmark](<https://devfeed.tech/tags/benchmark.md>), [benchmarks](<https://devfeed.tech/tags/benchmarks.md>), [code](<https://devfeed.tech/tags/code.md>), [developer-tools](<https://devfeed.tech/tags/developer-tools.md>), [evaluation](<https://devfeed.tech/tags/evaluation.md>), [github](<https://devfeed.tech/tags/github.md>), [llms](<https://devfeed.tech/tags/llms.md>), [secret-scanning](<https://devfeed.tech/tags/secret-scanning.md>), [security](<https://devfeed.tech/tags/security.md>)

### AI overview

This article explains how to evaluate LLM-based systems before moving them into production. Using GitHub secret scanning as an example, it emphasizes defining the product decision first, testing against realistic production conditions, accounting for ambiguity and edge cases, and balancing reduced false positives with sufficient recall.

### Source excerpt

These are the lessons we learned evaluating LLMs for real-world secret scanning. The post How to evaluate LLMs before production appeared first on The GitHub Blog.

## Introducing Moat: A Security Review for Your GitHub Account

DevFeed: [Introducing Moat: A Security Review for Your GitHub Account](<https://devfeed.tech/articles/introducing-moat-a-security-review-for-your-github-account-3882.md>)

Original publisher: [Read original article](<https://laravel.com/blog/moat-a-security-review-for-your-github-account>)

Author: Nuno Maduro

Published: 2026-05-25T11:30:00Z

Content type: article

Language: en

Sources: [Laravel Blog](<https://devfeed.tech/sources/laravel-blog.md>)

Topics: [GitHub](<https://devfeed.tech/topics/github.md>), [Security](<https://devfeed.tech/topics/security.md>), [Secret Scanning](<https://devfeed.tech/topics/secret-scanning.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [MFA](<https://devfeed.tech/topics/mfa.md>), [ci](<https://devfeed.tech/topics/ci.md>), [Maintainers](<https://devfeed.tech/topics/maintainers.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [ci](<https://devfeed.tech/tags/ci.md>), [github](<https://devfeed.tech/tags/github.md>), [maintainers](<https://devfeed.tech/tags/maintainers.md>), [pull-request](<https://devfeed.tech/tags/pull-request.md>), [review](<https://devfeed.tech/tags/review.md>), [secret-scanning](<https://devfeed.tech/tags/secret-scanning.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [security](<https://devfeed.tech/tags/security.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [workflow](<https://devfeed.tech/tags/workflow.md>)

### AI overview

The article introduces Moat, a read-only package that reviews the security posture of GitHub users, organizations, and repositories. It checks settings such as two-factor authentication, branch protection, signed commits, secret scanning, Dependabot alerts, workflow permissions, pinned actions, webhooks, and collaborator access, then reports configuration gaps and suggestions. The article emphasizes that Moat does not change settings, certify security, remediate compromises, or scan dependencies.

### Source excerpt

Moat scans your GitHub user, org, or repo with one command, and surfaces misconfigured security settings, including 2FA, pinned actions, branch protection, and more.

## Neon Joins GitHub's Secret Scanning Partner Program to Strengthen Database Security

DevFeed: [Neon Joins GitHub's Secret Scanning Partner Program to Strengthen Database Security](<https://devfeed.tech/articles/neon-joins-github-s-secret-scanning-partner-program-to-strengthen-database-security-5661.md>)

Original publisher: [Read original article](<https://neon.com/blog/neon-joins-githubs-secret-scanning-partner-program-to-strengthen-database-security>)

Author: Busra Demir

Published: 2025-04-02T14:24:49Z

Content type: news

Language: en

Sources: [Blog -- Neon Docs](<https://devfeed.tech/sources/blog-neon-docs.md>)

Topics: [GitHub](<https://devfeed.tech/topics/github.md>), [Secret Scanning](<https://devfeed.tech/topics/secret-scanning.md>), [Security](<https://devfeed.tech/topics/security.md>), [API keys](<https://devfeed.tech/topics/api-keys.md>), [Database](<https://devfeed.tech/topics/database.md>), [npm](<https://devfeed.tech/topics/npm.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [api-keys](<https://devfeed.tech/tags/api-keys.md>), [aws](<https://devfeed.tech/tags/aws.md>), [company](<https://devfeed.tech/tags/company.md>), [env-file-security](<https://devfeed.tech/tags/env-file-security.md>), [environment-variables](<https://devfeed.tech/tags/environment-variables.md>), [github](<https://devfeed.tech/tags/github.md>), [hashicorp-vault](<https://devfeed.tech/tags/hashicorp-vault.md>), [secret-scanning](<https://devfeed.tech/tags/secret-scanning.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [security](<https://devfeed.tech/tags/security.md>), [security-best-practices](<https://devfeed.tech/tags/security-best-practices.md>)

### AI overview

Neon announces its participation in GitHub's Secret Scanning Partner Program. GitHub detects exposed Neon database credentials and API keys in public repositories and npm packages, then Neon validates the credentials, alerts its security team through Slack, and notifies affected customers. The article also recommends environment variables, secret management tools, and regular credential rotation.

### Source excerpt

We're excited to announce that Neon is now a GitHub Secret Scanning Partner, joining a group of leading enterprises and technology firms working to enhance security. This partnership helps protect Neon users by automatically detecting exposed Neon database credentials and API key...

## Hugging Face partners with TruffleHog to Scan for Secrets

DevFeed: [Hugging Face partners with TruffleHog to Scan for Secrets](<https://devfeed.tech/articles/hugging-face-partners-with-trufflehog-to-scan-for-secrets-7543.md>)

Original publisher: [Read original article](<https://huggingface.co/blog/trufflesecurity-partnership>)

Author: Luc Georges

Published: 2024-09-04T00:00:00Z

Content type: news

Language: en

Sources: [Hugging Face - Blog](<https://devfeed.tech/sources/hugging-face-blog.md>)

Topics: [hugging face](<https://devfeed.tech/topics/hugging-face.md>), [Secret Scanning](<https://devfeed.tech/topics/secret-scanning.md>), [Security](<https://devfeed.tech/topics/security.md>), [API keys](<https://devfeed.tech/topics/api-keys.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [passwords](<https://devfeed.tech/topics/passwords.md>)

Tags: [api-keys](<https://devfeed.tech/tags/api-keys.md>), [hub](<https://devfeed.tech/tags/hub.md>), [hugging-face](<https://devfeed.tech/tags/hugging-face.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [partnerships](<https://devfeed.tech/tags/partnerships.md>), [passwords](<https://devfeed.tech/tags/passwords.md>), [secret-scanning](<https://devfeed.tech/tags/secret-scanning.md>), [security](<https://devfeed.tech/tags/security.md>), [tokens](<https://devfeed.tech/tags/tokens.md>)

### AI overview

Hugging Face describes its partnership with TruffleHog to improve secret scanning. TruffleHog scans files and repositories for leaked credentials, tokens, API keys, and encryption keys, and verifies whether detected secrets work. Hugging Face added TruffleHog to its automated repository-scanning pipeline and is developing a native Hugging Face scanner in TruffleHog so users can scan their account data for leaked secrets.

### Source excerpt

We're on a journey to advance and democratize artificial intelligence through open source and open science.

## Nightfall AI and Snyk unite to deliver AI-powered secrets scanning for developers

DevFeed: [Nightfall AI and Snyk unite to deliver AI-powered secrets scanning for developers](<https://devfeed.tech/articles/nightfall-ai-and-snyk-unite-to-deliver-ai-powered-secrets-scanning-for-developers-8032.md>)

Original publisher: [Read original article](<https://snyk.io/blog/nightfall-ai-and-snyk-partner/>)

Author: LaToya Muff

Published: 2023-11-29T06:00:00Z

Content type: article

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [Secret Scanning](<https://devfeed.tech/topics/secret-scanning.md>), [Security](<https://devfeed.tech/topics/security.md>), [API keys](<https://devfeed.tech/topics/api-keys.md>), [Application Security](<https://devfeed.tech/topics/application-security.md>), [Cloud](<https://devfeed.tech/topics/cloud.md>), [Machine Learning, Security Attacks](<https://devfeed.tech/topics/machine-learning-security-attacks.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>)

Tags: [acquisition](<https://devfeed.tech/tags/acquisition.md>), [ai](<https://devfeed.tech/tags/ai.md>), [api](<https://devfeed.tech/tags/api.md>), [api-keys](<https://devfeed.tech/tags/api-keys.md>), [application-security](<https://devfeed.tech/tags/application-security.md>), [awareness](<https://devfeed.tech/tags/awareness.md>), [blog](<https://devfeed.tech/tags/blog.md>), [chatgpt](<https://devfeed.tech/tags/chatgpt.md>), [devops](<https://devfeed.tech/tags/devops.md>), [executive](<https://devfeed.tech/tags/executive.md>), [related-content](<https://devfeed.tech/tags/related-content.md>), [secret-scanning](<https://devfeed.tech/tags/secret-scanning.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [security](<https://devfeed.tech/tags/security.md>), [snyk](<https://devfeed.tech/tags/snyk.md>), [snyk-platform](<https://devfeed.tech/tags/snyk-platform.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>)

### AI overview

Snyk and Nightfall AI partnered to provide AI-powered secrets scanning for developers. Nightfall detects sensitive data such as PII, credentials, secrets, and API keys across cloud environments and supports contextual detection, custom rules, and developer-focused remediation alongside Snyk's code scanning capabilities.

### Source excerpt

While Snyk provides a comprehensive approach to developer security by securing critical components of the software supply chain, we recognize the increasing risk of exposed secrets in the cloud. So, we've tapped Nightfall AI to provide a critical feature for developer security: advanced secrets scanning.

## Supabase Beta March 2022

DevFeed: [Supabase Beta March 2022](<https://devfeed.tech/articles/supabase-beta-march-2022-315.md>)

Original publisher: [Read original article](<https://supabase.com/blog/beta-update-march-2022>)

Author: Ant Wilson

Published: 2022-04-15T07:00:00Z

Content type: release

Language: en

Sources: [Supabase Blog](<https://devfeed.tech/sources/supabase-blog.md>)

Topics: [Supabase](<https://devfeed.tech/topics/supabase.md>), [GraphQL](<https://devfeed.tech/topics/graphql.md>), [JavaScript](<https://devfeed.tech/topics/javascript.md>), [TypeScript](<https://devfeed.tech/topics/typescript.md>), [observability](<https://devfeed.tech/topics/observability.md>), [Secret Scanning](<https://devfeed.tech/topics/secret-scanning.md>)

Tags: [graphql](<https://devfeed.tech/tags/graphql.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [release](<https://devfeed.tech/tags/release.md>), [secret-scanning](<https://devfeed.tech/tags/secret-scanning.md>), [typescript](<https://devfeed.tech/tags/typescript.md>)

### AI overview

Supabase's March 2022 beta update announces JavaScript and TypeScript edge functions, GraphQL database queries, Realtime multiplayer and presence support, enterprise logging and observability features, and GitHub secret-scanning integration.

### Source excerpt

Functions, GraphQL, and much more.

## Community Day

DevFeed: [Community Day](<https://devfeed.tech/articles/community-day-344.md>)

Original publisher: [Read original article](<https://supabase.com/blog/community-day-lw4>)

Author: Thor Schaeff

Published: 2022-03-28T07:00:00Z

Content type: article

Language: en

Sources: [Supabase Blog](<https://devfeed.tech/sources/supabase-blog.md>)

Topics: [Supabase](<https://devfeed.tech/topics/supabase.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Secret Scanning](<https://devfeed.tech/topics/secret-scanning.md>), [API keys](<https://devfeed.tech/topics/api-keys.md>), [For the Love of Code](<https://devfeed.tech/topics/for-the-love-of-code.md>)

Tags: [api-keys](<https://devfeed.tech/tags/api-keys.md>), [community](<https://devfeed.tech/tags/community.md>), [contributors](<https://devfeed.tech/tags/contributors.md>), [github](<https://devfeed.tech/tags/github.md>), [hackathon](<https://devfeed.tech/tags/hackathon.md>), [launch](<https://devfeed.tech/tags/launch.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [partners](<https://devfeed.tech/tags/partners.md>), [secret-scanning](<https://devfeed.tech/tags/secret-scanning.md>)

### AI overview

Supabase's Community Day opens Launch Week 4 by celebrating contributors, partners, and open-source communities. The article outlines the week's feature launches and follow-on virtual hackathon, and announces Supabase's partnership with GitHub to scan for Supabase service role API keys.

### Source excerpt

Kicking off Launch Week 4 with contributors, partners, and friends.