{
  "id": 12270324,
  "title": "A secret scanner that blocks git push gets turned off",
  "url": "https://urgent.news/2026/10/06/a-secret-scanner-that-blocks-git-push-gets-turned-off",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-06T00:57:37.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/luckypipewrench/a-secret-scanner-that-blocks-git-push-gets-turned-off-20o5"
  },
  "original_language": "en",
  "account": "A secret scanner that blocks GitHub push traffic is disabled after causing issues for users. When a GitHub token is sent to GitHub, the scanner interprets the token as suspicious and blocks it. To resolve this, users can either exempt GitHub.com from scanning or disable the rule. The exemption method stops checking the token from being sent to GitHub, including in public repositories or gists. Disabling the rule means no monitoring of where the token goes at all. This false-positive issue is more common than missed detections. The proper approach is to determine if the data is a credential and where it should be sent. Credentials have specific destinations based on provider documentation. Pipelock 3.6 utilizes these audience settings, which are pre-defined for each credential class based on provider documentation. These settings prevent misconfigurations where a token can be used in unintended ways. The scanner also checks if the token is being used for its intended purpose, such as creating a public gist with sensitive code. However, this does not prevent the token from being misused. It is crucial to ensure that agent traffic goes through the scanner to maintain security.",
  "summary": "A DLP rule that blocks a GitHub token on its way to GitHub is a broken rule. You find that out the first afternoon your agent tries to git push . The agent has a token because you gave it one. It uses the token to talk to the service that issued it. That's the job. But a secret scanner that only asks \"is this a credential?\" sees ghp_ followed by thirty-six characters and blocks it. So the usual…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}