A leaked API key can hide in a CI build log, not just in source code. GitHub now has a preview that checks completed Actions workflow logs for supported secrets.
Announced on November 9, 2026, the feature adds another place to look for credentials accidentally printed during builds and deployments. But it is not enabled for everyone.
What the new scan actually does
After a GitHub Actions workflow finishes, secret scanning checks its logs against supported provider patterns. Matches appear in the repository’s existing secret scanning alerts, with a link to the relevant workflow log.
For supported secret types, GitHub can also run validity checks. An alert remains visible even if the workflow log is subsequently deleted, which helps teams investigate an incident.
Who can turn it on?
This is a public preview for GitHub Enterprise Cloud enterprises with GitHub Secret Protection or GitHub Advanced Security. GitHub says the preview also covers eligible enterprises using data residency on GHE.com.
- As an enterprise owner, open enterprise Settings.
- Go to Policies → Advanced Security.
- Find Secret scanning for Actions workflow logs and select Enabled under All repositories.
- Check the repository’s secret scanning alerts after new workflow runs finish.
The policy starts disabled and applies only to repositories that already have secret scanning enabled under the required licenses.
Three limitations worth knowing
- No historical scan: workflow runs completed before enabling the feature are not backfilled.
- Not every secret is detected: generic and custom patterns, AI-detected secrets, and secrets already masked by Actions are excluded.
- No preview notifications: log-derived alerts do not send notifications yet. Review the alert list yourself.
What should developers do?
Check whether your enterprise is eligible, enable the policy if appropriate, and review alerts after sensitive deployment workflows. Keep masking credentials and minimizing log output; scanning is a fallback, not permission to print secrets.
If you find a real exposed credential, revoke or rotate it and investigate where it was used. Deleting a log alone does not make a compromised token safe.