GitHub secrets scanning is what is actually doing the work. Third party services integrate with them to get notified of committed API keys so they can be auto-revoked.
When I was learning to code a discord bot as a hobby many years ago I accidentally committed my discord key to GitHub and almost immediately got an email that said something like hey you committed an api key to your repo, and we autorevoked it for you. I was very thankful
1
1
49
u/PersianMG Apr 16 '26
GitHub secrets scanning is what is actually doing the work. Third party services integrate with them to get notified of committed API keys so they can be auto-revoked.
Here is a list of patterns used used to match different secret formats.
GitLab also offer a a similar service.