GitHub's New Approach to Detecting Hardcoded Secrets: What You Need to Know

Starting May 30, 2025, GitHub is making a significant change to its security scanning tools. CodeQL will no longer generate alerts for hardcoded secrets, a move that aims to streamline the process of detecting sensitive information in your repositories. This change shifts the focus to GitHub’s Secret Scanning feature, which boasts improved precision and recall. But what does this mean for developers, and how should you adjust your security strategy?

In this article, we explore the upcoming changes, why they’re happening, and how you can start using GitHub’s Secret Scanning to enhance the security of your code.

What’s Changing?

On May 30, 2025, GitHub will disable CodeQL’s detection of hardcoded secrets, which aligns with the release of CodeQL 2.21.4. When this update is implemented, any CodeQL alerts related to hardcoded secrets in your repositories will be closed the next time the repository undergoes a CodeQL scan. However, these alerts will remain in your historical security alert backlog.

The specific CodeQL queries that will be disabled include a wide range of languages, including JavaScript, Swift, C, Python, Go, and Ruby. These queries have been designed to catch hardcoded secrets like passwords, API keys, and database credentials, but they have proven redundant in comparison to GitHub’s Secret Scanning feature, which is more effective at catching such issues.

GitHub’s Secret Scanning scans for over 300 types of hardcoded secrets and uses Copilot to detect generic passwords, making it a more comprehensive solution. By switching to Secret Scanning, GitHub hopes to centralize the management of alerts, providing developers with a clearer, more streamlined security workflow.

Why Is This Change Happening?

The transition away from CodeQL’s detection of hardcoded secrets comes as part of a broader effort to simplify security workflows and reduce redundancies. While CodeQL has long been a valuable tool for code analysis, its ability to detect hardcoded secrets has been found to overlap with GitHub’s Secret Scanning feature. This overlap leads to duplicate alerts for the same secrets, creating unnecessary manual work for developers.

Secret Scanning not only improves the accuracy of detection but also enhances the context provided for remediation. This feature offers more precise identification of hardcoded secrets and better metadata, giving developers the information they need to resolve vulnerabilities faster and more effectively.

How Do I Get Started with GitHub Secret Scanning?

To take advantage of GitHub’s Secret Scanning, you can start by exploring GitHub Secret Protection. This feature scans your repositories for hardcoded secrets across various languages and services. You can also access video tutorials and documentation to help you deploy and manage Secret Protection at scale.

GitHub Secret Scanning is part of GitHub’s broader initiative to improve security for all users, particularly in enterprise environments. Whether you’re a solo developer or part of a larger organization, implementing Secret Scanning can significantly reduce the risk of sensitive data exposure.

What Undercode Say:

As developers, we’re always looking for ways to optimize our workflows while maintaining the highest levels of security. GitHub’s decision to shift from CodeQL to Secret Scanning is a logical step towards improving both accuracy and efficiency. CodeQL’s alerts for hardcoded secrets were useful but redundant in the face of Secret Scanning’s superior capabilities.

By centralizing secret detection in one place, GitHub is simplifying security management and removing the headache of deduplicating alerts. This change will undoubtedly improve the development process, especially in large-scale projects where managing multiple alert systems can become overwhelming.

Moreover, the inclusion of Copilot in Secret Scanning adds a level of sophistication that’s hard to beat. It’s not just about detecting secrets; it’s about providing actionable insights that can guide developers through the remediation process. This shift is a reminder that the security landscape is always evolving, and as developers, we must be ready to adapt to better tools and practices.

With the transition to Secret Scanning, GitHub is reinforcing its commitment to helping developers keep their code secure without overburdening them with unnecessary complexity. The tool’s focus on accuracy and ease of use aligns with modern security needs, and it will likely be a welcome change for developers across the board.

Fact Checker Results:

GitHub’s new Secret Scanning feature will provide more accurate and comprehensive detection of hardcoded secrets compared to CodeQL.
The shift to Secret Scanning will help reduce redundant alerts, making security management more efficient.
The update will be part of CodeQL 2.21.4, with changes also included in GHES 3.18.