GitHub Secret Scanning Push Protection free tier and limits
Blocks git pushes that contain recognized secrets (API keys, tokens, private keys) before they land in your repository.
What the free plan gives you
- Push protection for users is on by default for every GitHub.com account
- Stops you from pushing supported secrets to public repositories
Best for
Everyone. AI tools often paste keys straight into code.
Watch out
The default user-level protection covers public repos only. Repository-level push protection requires GitHub Secret Protection to be enabled.
Fix guides that use GitHub Secret Scanning Push Protection
Other security options
Gitleaks
An open-source command-line tool that scans git repositories, files and history for hardcoded secrets. Can run locally, as a pre-commit hook or in CI.
Free Open source and free to run
Snyk
Scans your dependencies (SCA), source code (SAST), infrastructure-as-code and containers for known vulnerabilities, with IDE, CLI and Git integrations.
Free Free plan for individual developers and small teams
Cloudflare (Free plan)
Put Cloudflare's proxy and DNS in front of your domain for DDoS mitigation, a CDN and a free SSL certificate, whichever host you use.
Free DDoS mitigation and global CDN