Integrate GitHub Secret Scanning alerts with Vulnetix. Export secret scanning alerts via the GitHub REST API for centralised tracking and remediation.
Run GitHub Secret Scanning in CI
Scan on every push and upload the report as a workflow artifact:
- name: Export GitHub Secret Scanning alerts
run: |
gh api "/repos/${{ github.repository }}/secret-scanning/alerts?state=open&per_page=100" > secret-scanning-alerts.json
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Upload to Vulnetix
run: vulnetix upload --file secret-scanning-alerts.json
How Vulnetix compares: better together
Vulnetix does not replace GitHub Secret Scanning. Keep running it. Vulnetix sits on top of GitHub Secret Scanning (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
| Capability | Vulnetix | GitHub Secret Scanning |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ✗ |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ✗ |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ✗ |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ✗ |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ✗ |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ✓ Core: 200+ token types, partner revocation, push protection, validity checks |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ✗ |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ✗ |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ✗ |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ✗ |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ✗ |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ✗ |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✗ |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ✗ |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ✗ |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ✗ |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ✗ |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ✗ |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ✗ |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ✗ |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What GitHub Secret Scanning does well
- Partner program with 100+ service providers enables automatic token revocation, a detected leaked secret can be invalidated by the issuer, unmatched by standalone scanners
- Zero-config coverage of full git history, plus issues, PRs, discussions, wikis and gists; free and on-by-default for public repos
- Push protection blocks secrets before they ever enter history, and validity checks confirm whether a leaked credential is still live to prioritise remediation
- Custom regex patterns and Copilot-assisted detection of unstructured secrets for org-specific credentials
Where Vulnetix adds to it: GitHub Secret Scanning is deeply integrated into GitHub and unbeatable for partner revocation; Vulnetix does not replace it. Vulnetix ingests its alerts and correlates them with SCA, SAST, container and IaC findings across all repos and non-GitHub sources into one deduplicated, exploit-intel-prioritised queue with versioned VEX and SSVC. Better together: GitHub blocks/revokes at the edge, Vulnetix gives the cross-scanner ASPM view GitHub AS alone lacks.
No migration, no rip-and-replace. GitHub Secret Scanning keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise GitHub Secret Scanning results in Vulnetix
Upload GitHub Secret Scanning JSON output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.