What is the purpose of GitHub's 'token scanning' feature for GitHub Apps and OAuth tokens?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Secret scanning covers GitHub's own token formats too. When an active GitHub App installation token or OAuth token is spotted in a public repo, GitHub notifies the app owner through the secret scanning partner program and can automatically revoke it.
Full explanation below image
Full Explanation
GitHub's secret scanning includes support for detecting and responding to exposed GitHub tokens in addition to third-party credentials. Specifically: (1) When a GitHub Apps installation token or user-to-server OAuth token is detected in a public repository, GitHub's secret scanning engine identifies it. (2) As part of the secret scanning partner program, GitHub can automatically revoke the exposed token. (3) The organization and/or app owner receives a notification about the exposure. This is part of GitHub's broader effort to protect the GitHub ecosystem itself. The automatic revocation is a critical feature — it minimizes the window of exposure from when a token is accidentally committed to when it becomes unusable by an attacker. This coverage extends to GitHub PATs and other GitHub-issued credentials.