Post

20,000+ secret scanning alerts across 15,000 repos. Nine months later, GitHub reached inbox zero.

The key was separating noise from real risk, validating active credentials, finding owners, and making remediation a shared responsibility across engineering.

24/7/26, 10:48 pm0 reposts7 likes

GitHub

@github.com

24 July

Here's how we did it ⬇️

github.blogHow GitHub used secret scanning to reach inbox zeroGitHub had 20,000+ secret scanning alerts across 15,000 repositories. Here's how we separated signal from noise and built remediation workflows.