Public monitoring adds triage, validity, API, and webhooks

GitHub launched a major update to its public monitoring capability for secret scanning, adding enterprise alert triage, automated token validity checks, programmatic API access, and real-time webhook events. According to GitHub Changelog's report, the tool helps organizations remediate leaked credentials detected across public repositories at scale. Monitored leaks are attributed to enterprise accounts using organization membership and verified company domains. The update allows security personnel to organize, evaluate, and trace incident responses directly within their primary management consoles without external tracking tools.

This report details the expanded public monitoring architecture for enterprise administrators, security managers, and platform engineers. We examine the alert management workflows inside the enterprise security dashboard, the continuous background token verification engine, and how automation developers can route findings into incident response pipelines through dedicated REST endpoints and webhook listeners. For organizations running GitHub Enterprise Cloud, these capabilities automate key remediation steps, eliminate manual spreadsheet reviews, and preserve an auditable trail of all security decisions across monitored public repositories.

What Public monitoring shipped

The update introduces an alert management console inside the enterprise security dashboard to help security teams triage public secret leaks systematically. Enterprise administrators and enterprise security managers can now review exposures and dismiss alerts by marking them as either Dismissed or Fixed. Operators can add an optional comment explaining the remediation rationale, and closed alerts can be reopened if circumstances change. Alongside status transitions, the platform adds an activity timeline that records a comprehensive audit trail of all actions and state changes taken on an alert.

To assist security teams managing large alert volumes, the dashboard incorporates multi-criteria filtering and sorting controls. Analysts can filter the alert queue by repository, committer, secret type, alert state between open and closed, and attribution method, which differentiates between organization membership and verified company domains. In parallel, GitHub rolled out always-on validity checks across supported secret types. This automated engine continuously inspects credential status with token providers, displaying findings as Active, Inactive, or Unknown so security responders can prioritize live exposures immediately over dormant tokens.

What changed for builders in Public monitoring

Platform engineers and security automation teams can now bypass manual dashboard reviews by integrating public monitoring findings into existing security orchestration pipelines. Enterprise administrators and enterprise security managers can query attributed exposures programmatically through a new REST API endpoint. The query returns structured payloads detailing alert metadata, secret classifications, attribution models, and exposed repository locations. Complementing the API, an enterprise-level webhook event streams real-time notifications whenever a newly detected secret leak matches an organization's attribution rules, enabling automated incident handling across external enterprise defense tools.

Programmatic access and automated verification accelerate remediation across distributed developer environments. Automated services can ingest webhook events, check if the validity engine marked the token as Active, and invoke external revocation workflows within seconds of leak detection. Teams can also run scheduled batch queries via the REST endpoint to identify exposure patterns across specific repositories or committer identities. Exposing alert updates, attribution methods, and file coordinates through standard JSON payloads allows organizations to unify public repository monitoring with central security operations centers and ticketing pipelines.

How to install or upgrade Public monitoring

Public monitoring operates as a cloud-native service within the enterprise security dashboard rather than requiring local client packages, command-line installations, or infrastructure deployments. Enterprise administrators and enterprise security managers can turn on the feature and configure alert policies directly within their enterprise security settings. The functionality is available for GitHub Enterprise Cloud customers, including organizations using GitHub Enterprise Cloud with data residency. Eligible enterprises with a GitHub Advanced Security or GitHub Secret Protection license receive the entire alert management, validity checking, API, and webhook toolset at no additional cost.

# Query enterprise public monitoring alerts via curl
curl -L \
  -X GET \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer YOUR_ENTERPRISE_TOKEN" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  "https://api.github.com/enterprises/{enterprise}/secret-scanning/public-monitoring-alerts"

To establish real-time ingestion, platform teams subscribe to the secret_scanning_public_monitoring_alert event in the enterprise webhook configuration interface. Once configured, GitHub delivers JSON payloads detailing the alert identifier, credential type, attribution mechanism, and repository location directly to enterprise webhook handlers. Engineers can query the REST API endpoint using curl or the GitHub CLI to verify access permissions and inspect incoming response schemas. Combining automated webhook dispatch with periodic REST API queries establishes a resilient data pipeline that keeps internal incident management tools synchronized with public monitoring discoveries.

Gotchas and compatibility in Public monitoring

A primary operational caveat is that closing an alert in the enterprise security dashboard changes status only within the enterprise view. Dismissing an alert or marking it as Fixed does not revoke the exposed credential at the provider, nor does it remove the secret from the public repository or Git history. Security responders must still perform external key revocation and rotation across impacted services. Relying solely on dashboard dismissal without invalidating the actual credential leaves production environments vulnerable to ongoing credential abuse by unauthorized third parties who find the leak.

Compatibility and role requirements present distinct boundaries during deployment. Public monitoring remains in public preview and is accessible only to GitHub Enterprise Cloud accounts, including environments configured with data residency. Always-on validity verification is limited to supported secret types and provider integrations; unsupported credentials display an Unknown status rather than a verified operational state. Furthermore, access to the REST API, webhook subscriptions, and triage controls is restricted to enterprise administrators and enterprise security managers, preventing individual organization owners and repository maintainers from viewing alerts independently.

What to watch after Public monitoring

Organizations implementing public monitoring should formalize triage standards across their internal security teams. Security leadership must define operational policies for when to mark alerts as Fixed versus Dismissed, establish mandatory comment standards during dismissals, and audit state transitions through the activity timeline. Incorporating validity statuses into triage playbooks enables analysts to filter out Inactive tokens during initial reviews and immediately escalate Active credentials to high-priority incident queues. Reviewing attribution methods also helps verify whether detections stem from organization membership or verified corporate domains, preventing misattributed exposures.

Security teams should follow upcoming developments as GitHub refines public monitoring throughout the public preview phase. Expansion of provider partnerships will broaden the range of supported secret types, moving additional credentials from Unknown states to confirmed Active or Inactive statuses. Enterprise teams can participate in roadmap discussions and share triage feedback through the official GitHub Community forum. Monitoring updates to webhook payloads and REST endpoints will ensure enterprise SIEM connectors and automation playbooks stay synchronized as GitHub introduces further alert management capabilities for public code security.