A build log can expose an API key even when the key never appears in the code. A verbose script or debugging command can print it to the output of a job. GitHub’s new preview looks for supported provider secrets in those logs after a workflow finishes.
The feature is available to eligible GitHub Enterprise Cloud customers. Enterprise owners must enable it, and it applies to repositories with secret scanning enabled under the required license. Any alerts appear alongside the repository’s other secret scanning findings.
The preview only scans runs completed after it is enabled. It does not backfill earlier logs or send notifications for these findings during the preview.