From c3958a3eb37780902676b48b8e24d6cccbaf6161 Mon Sep 17 00:00:00 2001 From: Anne-Marie <102995847+am-stead@users.noreply.github.com> Date: Wed, 25 Sep 2024 10:46:44 +0100 Subject: [PATCH] Update content/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts.md Co-authored-by: Erin Havens --- .../managing-alerts-from-secret-scanning/resolving-alerts.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts.md b/content/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts.md index eaf7bde67b..748c1a2964 100644 --- a/content/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts.md +++ b/content/code-security/secret-scanning/managing-alerts-from-secret-scanning/resolving-alerts.md @@ -22,7 +22,7 @@ allowTitleToDifferFromFilename: true Once a secret has been committed to a repository, you should consider the secret compromised. {% data variables.product.github %} recommends the following actions for compromised secrets: * Verify that the secret committed to {% data variables.product.github %} is valid. {% ifversion fpt or ghes %}**Applies to {% data variables.product.company_short %} tokens only**. See "[Checking a secret's validity](/code-security/secret-scanning/managing-alerts-from-secret-scanning/evaluating-alerts#checking-a-secrets-validity)."{% endif %}{% ifversion secret-scanning-validity-check-partner-patterns %}See "[Performing an on-demand validity check](/code-security/secret-scanning/managing-alerts-from-secret-scanning/evaluating-alerts#performing-an-on-demand-validity-check)".{% endif %}{% ifversion secret-scanning-report-secret-github-pat %} -* {% ifversion ghec %}For secrets detected in private repositories, r{% else %}R{% endif %}eport the leaked secret to {% data variables.product.github %}. **Applies to {% data variables.product.company_short %} tokens only**. See "[Reporting a leaked secret](#reporting-a-leaked-secret)." {% endif %} +* {% ifversion ghec %}For secrets detected in private repositories, r{% else %}R{% endif %}eport the leaked secret to {% data variables.product.github %}, who will treat it like any publicly leaked secret and revoke it. **Applies to {% data variables.product.company_short %} personal access tokens only**. See "[Reporting a leaked secret](#reporting-a-leaked-secret)." {% endif %} * Review and update any services that use the old token. For {% data variables.product.github %} {% data variables.product.pat_generic %}s, delete the compromised token and create a new token. See "[AUTOTITLE](/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token)." * Check your security logs for any unauthorized activity. [TODO - LINK?]