GitHub secret scanning now detects secrets in Actions workflow logs

GitHub announced on November 9, 2026 that its secret scanning tool now detects secrets leaked inside GitHub Actions workflow run logs, extending coverage that previously applied only to code, issues, wikis, discussions and pull requests, according to GitHub's changelog post.

What changed

• Secret scanning now covers GitHub Actions workflow logs, in addition to issues, wikis, discussions and pull requests.
• The capability is in public preview for enterprises on GitHub Enterprise Cloud with GitHub Secret Protection or GitHub Advanced Security.
• Enterprise owners turn it on from enterprise settings under Policies > Advanced Security.
• Scanning runs when a workflow run completes, and findings appear in the repository's existing secret scanning alert list with links back to the relevant workflow log.
• Validity checks run for supported secret types, and alerts persist even if the underlying workflow log is later deleted.

Why it matters for builders

CI logs are a common place for credentials to leak accidentally, especially as more teams run AI agents and automation inside Actions workflows, and this closes a blind spot that code-only secret scanning missed.

Availability and limitations

• Only workflow runs completed after the feature is enabled are scanned; historical logs are not backfilled.
• Generic patterns, custom patterns, AI-detected secrets and secrets already masked by Actions are not detected by this capability.
• No notifications are generated for alerts during the preview period, so users must check the alert list directly.

Sources

• Secret scanning detects secrets in GitHub Actions workflow logs (GitHub, November 9, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.