Updates to GitHub secret scanning
By Steven Van ·
Enterprise audit log events switch the business field to the enterprise slug on November 12, alongside several secret scanning fixes.
GitHub is changing what the business field holds in some secret scanning audit log events. On November 12, 2026, in affected secret_scanning_alert.* and secret_scanning_push_protection.bypass events, the field will switch from the enterprise display name to the enterprise slug. The GitHub secret scanning update also lists several improvements and bug fixes.
Audit log change on November 12
The business field remains a string. Event names and numeric business_id values are unchanged. Integrations that filter by display name should be updated before the rollout to accept both formats, or to use business_id instead, to avoid disrupting automated workflows.
Improvements
- Custom pattern alerts: when a rescan finds that existing open alerts still match an edited custom pattern, they stay open rather than being closed and reopened.
- Base64-encoded GitHub tokens: in private and internal repositories on github.com with secret scanning enabled, the existing revocation action (public preview) now supports encoded personal access tokens (classic), fine-grained personal access tokens, OAuth access tokens and GitHub App user access tokens. GitHub decodes the value automatically.
- Dismissal-request webhooks: payloads now include exemption_request.number, the repository-scoped request number also available in the REST API. The repository and request number together can be used to correlate requests across integrations.
- Accessibility: the Request pending status on an alert is now keyboard-focusable without activating an action. The revocation flow announces progress to screen readers and moves focus to its completion panel when the panel appears.
Bug fixes
- Bypass-request metadata: fixed empty secret-type and location details in bypass-request API responses and webhook payloads for command-line pushes when another repository rule ran after secret scanning.
- Delegated bypass: fixed push failures caused by existing organization-role entries in reviewer lists, and 500 errors when setting valid reviewer configurations for organization-owned repositories through the REST API.
- Custom pattern API: requests rejected by the scanning service for invalid arguments now return 422 instead of 500, so integrations can tell input errors from server failures.
