Secret scanning blocks Anthropic keys by default, adds Salesforce
By Steven Van ·
Cloudsmith API key detection is also available, while Salesforce partner secrets found in public repositories are reported to the issuer.
Commits containing Anthropic service or user API keys are now blocked by default in repositories with secret scanning enabled, including free public repositories on GitHub. The update also adds detection for Cloudsmith API keys and Salesforce Marketing Cloud OAuth2 tokens.
New detectors and partner reporting
The new detectors cover anthropic_service_api_key, anthropic_user_api_key, and cloudsmith_api_key. User secrets generate secret scanning alerts when found in public or private repositories.
Salesforce joins the secret scanning partnership program with support for salesforce_marketing_cloud_api_oauth2_token. When partner secrets appear in public repositories, GitHub reports them directly to the issuer so it can revoke or rotate the credentials. These partner reports do not appear in repository alerts.
Availability
Secret scanning runs automatically for free in public repositories. Organization-owned private and internal repositories require GitHub Secret Protection on GitHub Team or GitHub Enterprise Cloud. The secret scanning documentation also lists support for user-owned repositories on Enterprise Cloud with Enterprise Managed Users, and Enterprise Server with Secret Protection enabled.
