Skip to main content
To scan your GitHub repositories for leaked secrets, create a GitHub data source in Infisical.

​
Prerequisites

​
Create a GitHub data source in Infisical

1
Go to Secret Scanning > Data Sources and select Add Data Source.Secret Scanning Dashboard
2
Select GitHub.Select GitHub Option
3
Select the connection to use and the repositories to scan, then select Next.Data Source Configuration
  • GitHub Radar Connection: The connection that can access the repositories you want to scan
  • Scan Repositories: Which repositories Infisical scans
    • All Repositories: Every repository the connection can access
    • Select Repositories: Only the repositories you select in Include Repositories
  • Auto-Scan Enabled: Whether Infisical scans each new push to the repositories
4
Enter a name and, optionally, a description for the data source, then select Next.Data Source Details
  • Name: A name that contains only lowercase letters, numbers, and hyphens
  • Description (optional): A description of the data source
5
Review the data source, then select Create Data Source.Data Source Review
6
The data source appears in Data Sources. If auto-scan is enabled, Infisical starts a historical scan of every repository.Data Source Created
7
To see the data source’s repositories and scan history, select the data source.Data Source Page
8
To review the secrets the scans found, go to Findings. To learn what each finding contains and how to change its status, see Findings.Findings Page

​
Pull request checks

If Scan New Commits is on for a GitHub data source, Infisical scans the commits of each pull request opened against a repository in the data source. Infisical reports the result as a check named Infisical Secret Scanning on the pull request, and scans the pull request again each time someone pushes to it.
  • If Infisical finds a secret in any commit of the pull request, the check fails and marks the file and line of each secret, unless the secret’s finding is marked as a false positive or ignored
  • If Infisical can’t finish the scan, the check fails, and you can re-run the check from the pull request
  • If Infisical finds no secrets, the check passes
  • If the pull request comes from a fork, Infisical doesn’t scan it and marks the check as skipped, which doesn’t block merging (Infisical scans its commits after they’re merged into the repository)
To stop a pull request that contains a secret from being merged, require the check in a branch protection rule. If the secrets on a failed check are false positives or safe to ignore, select Skip: False positive or Skip: Ignore on the check. Infisical sets that status on every finding the check failed on, records the GitHub user who selected it in the finding’s comment, and runs the check again. Anyone with write access to the repository can select these. To stop Infisical from reporting a value in any repository, add it to the allowlist in your scanning configuration.
If your GitHub organization installed the app for your GitHub Radar Connection before pull request checks were available, an organization owner has to accept the app’s new permissions in GitHub before Infisical can check pull requests.