LoFP LoFP / documented test of push protection using a dummy token, or a temporary disable while fixing a noisy pattern. re-enable afterward and confirm no live secret was pushed.

Techniques

Sample rules

GitHub Secret Scanning Push Protection Bypassed or Disabled

Description

Detects bypass of GitHub secret scanning push protection, approval of a bypass request, or disabling push protection at enterprise, organization, or repository scope. This is separate from turning secret scanning off. Bypass means a detected secret was allowed into the repository — the pattern used after tj-actions and similar CI secret-dump attacks.

Detection logic

from logs-github.audit-* metadata _id, _index, _version
| where
  data_stream.dataset == "github.audit"
    and event.action in (
      "secret_scanning_push_protection.bypass",
      "secret_scanning_push_protection_request.approve",
      "business_secret_scanning_push_protection.disable",
      "business_secret_scanning_push_protection.disabled_for_new_repos",
      "org.secret_scanning_push_protection_disable",
      "org.secret_scanning_push_protection_new_repos_disable",
      "repository_secret_scanning_push_protection.disable"
    )
| keep
    _id,
    _index,
    _version,
    @timestamp,
    event.action,
    user.name,
    github.org,
    github.repo,
    github.actor_ip,
    github.hashed_token,
    github.programmatic_access_type,
    github.user_agent,
    github.secret_type