> Or is that nonsense? Yes, that is nonsense. 1) secret scanning can be disabled (not even sure it's enabled by default). 2) the regexes are fairly specific,

> Or is that nonsense? Yes, that is nonsense. 1) secret scanning can be disabled (not even sure it's enabled by default). 2) the regexes are fairly specific, length limited, etc. 3) github is obviously reviewing regexes that are accepted. Check the list of stuff supported: https://docs.github.com/en/code-security/secret-scanning/secret-scanning-patterns#supported-secrets-for-user-alerts https://docs.github.com/en/code-security/secret-scanning/sec... A bit sad, they don't publish the list of regexes, etc. -------------- I added a similar thing to the package manager for Dart / Flutter, because we saw users accidentally publishing secrets. That code is public, it relies on regexes and entropy estimation: https://github.com/dart-lang/pub/blob/eb8ee21a089ebe0f2c2dd89802d63e51cb62f8b6/lib/src/validator/leak_detection.dart#L207-L219 https://github.com/dart-lang/pub/blob/eb8ee21a089ebe0f2c2dd8... It was heavily inspired by the researchers in: https://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019_04B-3_Meli_paper.pdf https://www.ndss-symposium.org/wp-content/uploads/2019/02/nd... Worth a read, and certainly provides motivation for Github to do this kind of work :D (disclosure: I work for Google. The opinions stated here are my own)