GitHub Secret Scanning Update: Fix business Field Filters Before November 12
Also check Base64 token revocation, webhook numbers, and API error codes
Key takeaways
GitHub published a group of Secret Scanning improvements on October 20, 2026. The most time-sensitive change arrives on November 12: the business field in affected audit-log events will switch from an enterprise display name to the enterprise slug. Integrations should temporarily accept both formats or use the unchanged numeric business_id. The update also expands public-preview revocation for Base64-encoded GitHub tokens in eligible private and internal repositories, adds exemption-request numbers to dismissal webhooks, and returns HTTP 422 for rejected custom-pattern arguments. This article provides a read-only inventory and test-event plan for AI coding teams so reporting, alerts, and webhook correlation do not silently lose data.
By ENHE AI · 2026-10-22 · AI-assisted drafting and editorial checks.
Direct answer: fix audit filters first, then validate each additional change
The business field format change is the urgent item. Search queries, dashboards, and alerts in read-only mode, then accept both display name and slug or move to stable business_id. Do not discover the problem through missing production events after November 12.
What changes on November 12
Starting November 12, 2026, the business field in affected secret_scanning_alert.* and secret_scanning_push_protection.bypass audit events changes from the enterprise display name to the enterprise slug.
The field remains a string, while event names and numeric business_id values stay unchanged. GitHub recommends accepting both formats during the transition or using business_id.
Migration steps: read-only inventory, dual format, and a test event
Search every query, report, alert, and script that contains business, an enterprise display name, or Secret Scanning event names. Record the owner and impact before changing production rules.
In a test environment, accept both the old display name and new slug or use business_id. Use one test alert and one permitted bypass request to check ingestion, correlation, alerting, and reports.
If migration cannot finish before the date, retain dual-format handling and monitor missing counts. Do not remove old-format support until every source is confirmed to have changed.
Treat the additional improvements as separate changes
GitHub also expanded revocation for Base64-encoded classic and fine-grained personal access tokens, OAuth access tokens, and GitHub App user access tokens, with automatic decoding. Dismissal webhooks add exemption_request.number, and invalid custom-pattern arguments now return 422 instead of 500.
Impact for users and AI coding teams
AI coding agents interact more often with repository tokens, automation, and integrations, so audit fields and revocation are not merely administrator details. Users should not create a real leak for testing. Use test credentials or supported test events and keep secrets out of tickets and logs.
FAQ
Is replacing the display name with the slug enough?
It can work temporarily, but using unchanged business_id for identity and readable names for display is more robust.
Does Base64 token support cover every repository?
The announcement limits it to eligible private and internal repositories on github.com with Secret Scanning enabled, and revocation remains a public preview.
Related tools and reading
These pages support the same task, workflow, or risk boundary.
Conclusion
Complete the read-only inventory and dual-format test now, then change production rules before November 12. Validate the other improvements separately.
What this means for everyday users
AI coding agents interact more often with repository tokens, automation, and integrations, so audit fields and revocation are not merely administrator details. Users should not create a real leak for testing. Use test credentials or supported test events and keep secrets out of tickets and logs.
Related tutorials
Related reading
GitHub Updates Secret Scanning Coverage: Recheck AI Workflow Credentials
GitHub published Secret Scanning coverage updates on August 7, 2026. Expanded detectors and coverage can help teams find credentials in AI-generated code, automation, MCP services, and CI, but detection is not a guarantee that every secret will be found. The practical job is to inventory repository, branch, workflow, and local environment sources, confirm organization policy, and respond to an alert by revoking or rotating the credential before investigating history and impact. Bot and app permissions should be minimal, and a small incident drill should verify notification, ownership, deadlines, and postmortem steps. Treat scanning as the discovery layer of a credential lifecycle, not as permission to put secrets in prompts or logs.
GitHub Launches a Purpose-Built AI Model for Leaked Secret Detection
GitHub announced a purpose-built leaked-secret detection model on October 7, 2026. The model uses surrounding code to identify likely credentials, including passwords that do not follow a recognizable token format. Existing AI-detected alerts remain included with GitHub Secret Protection and GitHub Advanced Security, while the newer push-protection checks and Copilot security-review checks require explicit opt-in and are planned to consume AI Credits. This article separates the three surfaces so teams do not confuse an included repository scan with a credit-consuming pre-push or agent review. It also gives a practical response sequence: verify the finding, revoke and rotate an exposed credential, remove it from active code and history where appropriate, review access logs, set a budget with a real stop rule, and preserve evidence for follow-up.
What to Do After a Claude API Key Leak: A Seven-Step Response Checklist
GitHub added detection for anthropic_service_api_key and anthropic_user_api_key on October 13, 2026 and included both patterns in push protection by default for repositories with secret scanning enabled, including free public repositories. Prevention does not replace incident response. Anthropic recommends immediately revoking a suspected compromised key in Claude Console, using environment variables or encrypted secret storage, separating keys by environment and purpose, rotating keys, and scanning repositories. This durable seven-step checklist covers the full response: stop the affected workload, revoke the key, review usage and billing evidence, remove exposed copies from code and logs, issue a narrowly scoped replacement, redeploy and verify, then document the cause and add preventive controls. Never paste a real key into chat, screenshots, tickets, or public cleanup requests.
From Chat Boxes to Personal AI Companions: AI Assistants Are Entering the Desktop Execution Era
AI assistants are moving from answering questions toward continuing real tasks. AI agents, MCP tool ecosystems, personal memory, and local workbenches are pushing this shift together. For users, the real value is not another chat box, but less repeated context setup and more continuity from thinking to doing.
Eleven Realtime v1 Mini and Max Launch: Choosing a Voice-Agent Path
ElevenLabs launched Eleven Realtime v1 Mini and v1 Max on October 20, 2026. Both speech-to-speech models support more than 90 languages and over 17,000 voices, but they target different tasks: Mini emphasizes lower-cost natural conversations, while Max is designed for support, lead qualification, and multi-step work. This article offers a selection and migration checklist instead of repeating benchmark claims. It explains how to compare both models on the same script, what OpenAI Realtime API compatibility means, why WebRTC integrations must move to WebSocket, and when ElevenAgents is the better starting point for channels, knowledge bases, guardrails, testing, and monitoring.
GitHub CLI Adds Expiring OAuth Tokens: Check Git, Scripts, and Extensions First
GitHub announced an opt-in public preview of expiring, automatically refreshing OAuth credentials for GitHub CLI on October 21, 2026, beginning with version 2.103.0. Users can enable the behavior with gh auth login --expiring or a global configuration setting. Git over HTTPS should use gh auth setup-git, and Git 2.46 or newer is recommended to avoid caching credentials beyond their lifetime. This article focuses on AI coding tools, scripts, and extensions that capture gh auth token output once and reuse it. It provides an inventory, migration, and verification sequence so users can gain a shorter exposure window without unexpectedly breaking long-running automation.