GitHub announced a set of Secret Scanning and public monitoring updates on July 15, 2026. The release adds provider detectors and puts the secret category into the webhook payload, giving security teams a clearer way to route alerts from different detection sources.
GitHub says Resend is joining its secret scanning partnership program, and detection now covers APIclub and Resend API keys. When a partnership secret is found in a public repository, GitHub can forward the exposure to the secret issuer so it can revoke the secret or notify the relevant administrators.
Push Protection also has broader defaults. VolcEngine’s `volcengine_ark_api_key` is now included by default. Repositories with Secret Scanning enabled, including free public repositories, will automatically block a commit containing that secret before it is pushed.
For teams building integrations and automation, the most useful change is the new `secret_category` field in the `secret_scanning_alert` webhook. Findings are classified as `default` or `generic`: the first covers provider and custom patterns, while the second covers generic patterns and AI-detected secrets. Teams can filter, route, and report by category without maintaining their own mapping of secret types.
GitHub also improved the public monitoring alert list with insight cards at the top of the page. The cards show associated leaks by attribution, enterprise member counts, and verified domains, giving security teams a quick view of exposure before they inspect individual alerts.
The value is not only the extra detectors. Teams using AI coding agents, CI/CD, and webhook automation can route alerts by `secret_category`, verify the repository, commit, owner, and token scope, and then have the secret issuer or administrator rotate the credential. An AI-detected finding still needs triage and validation; a category is not proof of a confirmed leak.
Secret Scanning is not a complete credential-governance system. Teams still need least privilege, short-lived tokens, environment-variable management, historical-commit cleanup, and incident response. The practical improvement in this release is a clearer automation interface between detection, classification, notification, and rotation.
