GitHub clears 20,000 secret scanning alerts across 15,000 repos in nine months

GitHub says it cleared more than 20,000 secret scanning alerts across 15,000 repositories in nine months, turning a sprawling security backlog into inbox zero. That matters because leaked API keys and tokens are one of the most common ways software supply chains turn ordinary code mistakes into production incidents.

The tweet’s core line was: “20,000+ secret scanning alerts across 15,000 repos. Nine months later, GitHub reached inbox zero.”

The post points to a GitHub security write-up about separating noisy findings from active risk, validating live credentials, finding the right code owners, and making remediation a shared engineering responsibility. That operating model is the real story. At enterprise scale, secret scanning can create a flood of alerts; without ownership and triage, the alerts become another unmanaged queue.

GitHub’s main account often mixes product updates, security practices, and developer workflow examples. This post is notable because it uses GitHub’s own internal cleanup numbers rather than abstract advice. The 15,000-repository figure also makes the lesson transferable to large monorepo and multi-repo organizations where ownership is fragmented.

What to watch next is whether these practices show up as more opinionated product defaults: better owner detection, credential activity checks, risk scoring, and remediation workflows inside GitHub Advanced Security. If those pieces become automated, secret scanning moves from detection toward an operational control plane for leaked credentials. The source tweet is available here.