Secret scanning alerts API now supports hiding secret literals

You can now request secret scanning alerts through the API without exposing the actual secret literals. This new hide_secret query parameter helps reduce risk when working with secret scanning alert data for analytics, dashboards, or integrations.

This parameter is available on the following API endpoints:

• GET /enterprises/{enterprise}/secret-scanning/alerts
• GET /orgs/{org}/secret-scanning/alerts
• GET /repos/{owner}/{repo}/secret-scanning/alerts
• GET /repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}

To use this feature, add the hide_secret=true query parameter to any secret scanning alerts API request. When this value is set to true, the API response will omit the secret literal value. The default value is false, maintaining backward compatibility with existing integrations.

For more information, visit our secret scanning API documentation.