The News, Explained
On November 5, GitHub added SpaceX as a secret scanning partner and began recognizing the secret format for version 2 of Starlink’s public API. An API lets software send requests to a service. A secret is a string that proves the software has permission to make those requests. An API can be public while the credentials used to access it still need to be replaced if exposed. Source Source
Suppose someone commits a deployment configuration containing a secret to a public repository. If GitHub recognizes the supported Starlink secret format, it notifies SpaceX, which issued it. GitHub’s partner documentation says the issuer checks whether the string is a real credential and decides whether to revoke it, issue a replacement or contact the user. Detection, notification and disabling the old credential are separate steps. Source Source
GitHub also adjusted some detectors for existing providers, including AWS and Google. For example, the AWS access key ID detector suppresses a match if filtering leaves no qualifying companion credential. It uses nearby evidence of a matching credential to avoid treating an isolated string as a secret. Source
OYOPICK’s Take
Removing a line from a public repository and preventing anyone from using the exposed credential are two tasks worth tracking separately. GitHub advises revoking or rotating exposed credentials first. If an automated deployment relied on the old secret, the team should verify with the issuer that it has been disabled, then separately check that the deployment works with its replacement. Recording both outcomes lets the team benefit from the partner notification while keeping track of whether its own service has recovered. Source Source