Secret scanning detects Cloudflare service tokens

GitHub added a secret scanning detector for Cloudflare service tokens. The new secret type is cloudflare_access_service_token, and it's detected automatically in your repositories.

When a token turns up in a public repository, secret scanning reports it directly to Cloudflare through GitHub's partner program, so Cloudflare can act on it, such as revoking the credential. Those partner reports don't show up as alerts in your repo. In public or private repositories, a leaked token also generates a secret scanning alert for you.

Private and internal repositories owned by an organization need GitHub Secret Protection enabled on GitHub Team or GitHub Enterprise Cloud. Public repositories are scanned for free. If you get an alert, rotate the token right away. Revoking it usually matters more than scrubbing your Git history.