GitHub Blog
1. How GitHub used secret scanning to reach inbox zero
描述了GitHub将秘密扫描告警降至零的成功方法，提供了可扩展的秘密管理策略。 (score: 0.90)
GitHub Security found over 20,000 secrets across 15,000+ repositories. They implemented a phased approach: enable secret scanning everywhere, triage alerts, validate which secrets are live, identify owners, and automate remediation. After nine months, they reached zero open alerts. The article shares lessons learned and strategies for managing secrets at scale.
- GitHub discovered over 20,000 secrets across 15,000+ repositories.
- 90% of alerts were inactive test fixtures, reducing the real workload to ~2,000.
- They used a six-phase approach: enable everywhere, triage, validate, assign ownership, manual triage, systematize.
- They built validity checking to determine if credentials were still active.
- They partnered with support, incident response, and bug bounty teams.
- They tied secret remediation to the Engineering Fundamentals program for accountability.
- After nine months, they reached inbox zero.