> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# GitHub secret scanning

> Scan the repositories a GitHub Radar connection can access.

To scan your GitHub repositories for leaked secrets, create a GitHub [data source](https://infisical.com/docs/documentation/platform/secret-scanning/scan-repositories.md) in Infisical.

## Prerequisites

* A [GitHub Radar Connection](https://infisical.com/docs/integrations/app-connections/github-radar.md)

## Create a GitHub data source in Infisical

**Step 1**

Go to **Secret Scanning** > **Data Sources** and select **Add Data Source**.

![Secret Scanning Dashboard](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/secret-scanning/github/github-data-source-step-1.png)

**Step 2**

Select **GitHub**.

![Select GitHub Option](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/secret-scanning/github/github-data-source-step-2.png)

**Step 3**

Select the connection to use and the repositories to scan, then select **Next**.

![Data Source Configuration](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/secret-scanning/github/github-data-source-step-3.png)

* **GitHub Radar Connection**: The connection that can access the repositories you want to scan
* **Scan Repositories**: Which repositories Infisical scans
  * **All Repositories**: Every repository the connection can access
  * **Select Repositories**: Only the repositories you select in **Include Repositories**
* **Auto-Scan Enabled**: Whether Infisical scans each new push to the repositories

**Step 4**

Enter a name and, optionally, a description for the data source, then select **Next**.

![Data Source Details](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/secret-scanning/github/github-data-source-step-4.png)

* **Name**: A name that contains only lowercase letters, numbers, and hyphens
* **Description** (optional): A description of the data source

**Step 5**

Review the data source, then select **Create Data Source**.

![Data Source Review](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/secret-scanning/github/github-data-source-step-5.png)

**Step 6**

The data source appears in **Data Sources**. If auto-scan is enabled, Infisical starts a [historical scan](https://infisical.com/docs/documentation/platform/secret-scanning/scan-repositories.md#scans) of every repository.

![Data Source Created](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/secret-scanning/github/github-data-source-step-6.png)

**Step 7**

To see the data source's repositories and scan history, select the data source.

![Data Source Page](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/secret-scanning/github/github-data-source-step-7.png)

**Step 8**

To review the secrets the scans found, go to **Findings**. To learn what each finding contains and how to change its status, see [Findings](https://infisical.com/docs/documentation/platform/secret-scanning/findings.md).

![Findings Page](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/secret-scanning/github/github-data-source-step-8.png)

## Pull request checks

If **Scan New Commits** is on for a GitHub data source, Infisical scans the commits of each pull request opened against a repository in the data source. Infisical reports the result as a check named **Infisical Secret Scanning** on the pull request, and scans the pull request again each time someone pushes to it.

* If Infisical finds a secret in any commit of the pull request, the check fails and marks the file and line of each secret, unless the secret's finding is marked as a false positive or ignored
* If Infisical can't finish the scan, the check fails, and you can re-run the check from the pull request
* If Infisical finds no secrets, the check passes
* If the pull request comes from a fork, Infisical doesn't scan it and marks the check as skipped, which doesn't block merging (Infisical scans its commits after they're merged into the repository)

To stop a pull request that contains a secret from being merged, [require the check in a branch protection rule](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging).

If the secrets on a failed check are false positives or safe to ignore, select **Skip: False positive** or **Skip: Ignore** on the check. Infisical sets that status on every [finding](https://infisical.com/docs/documentation/platform/secret-scanning/findings.md) the check failed on, records the GitHub user who selected it in the finding's comment, and runs the check again. Anyone with write access to the repository can select these.

To stop Infisical from reporting a value in any repository, add it to the allowlist in your [scanning configuration](https://infisical.com/docs/documentation/platform/secret-scanning/configuration.md).

> [!NOTE]
>
> If your GitHub organization installed the app for your [GitHub Radar Connection](https://infisical.com/docs/integrations/app-connections/github-radar.md) before pull request checks were available, an organization owner has to accept the app's new permissions in GitHub before Infisical can check pull requests.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.