What shipped
GitHub expanded secret scanning to inspect GitHub Actions workflow logs when a run finishes. Supported provider credential patterns found in those logs generate repository secret-scanning alerts linked to the relevant run. The findings remain available even if the original logs are later deleted. That closes a different exposure route from committing a password or API key to source code.
The availability footnote is the real news for smaller teams. This is a public preview for GitHub Enterprise Cloud organizations licensed for GitHub Secret Protection or GitHub Advanced Security. An enterprise owner must explicitly enable it, and only subsequent completed runs are scanned. Existing logs are not backfilled.
Why a small team cares
Consider a three-developer shop using Actions to deploy a customer portal. A build step might print a full response from the hosting API, enable verbose shell tracing or include an environment dump during troubleshooting. If a credential slips into that output, deleting it from a code file does nothing to fix the copy already present in the run logs.
The risk increases when coding agents edit workflow YAML and nobody checks the final logging behavior. The team needs to know which jobs can access production secrets, who can read their logs and what gets printed on failure. Review is still necessary even when the workflow finishes successfully. A new GitHub detector cannot replace it.
Hype vs useful
Calling this automatic secret protection for every repository would be wrong. The preview is not available to ordinary GitHub plans, catches supported provider patterns rather than arbitrary secrets and does not cover generic or custom patterns. GitHub also says secrets already masked by Actions are not detected. Preview log alerts do not send notifications, so someone must open the alert list.
For eligible enterprise teams, turning the preview on is useful as an additional detection layer. For the much larger set of small development shops outside those licenses, this announcement is a prompt to change logging habits now: stop printing sensitive data, inspect recent jobs and rotate any key that has actually appeared in accessible output. Do not purchase enterprise security solely because this preview exists.
