Skip to content

[Fundamentals] Add GitHub Secret Scanning details to token formats page #29715

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ethulia wants to merge 1 commit into
base: production
Choose a base branch
from
+7 −2
Open

[Fundamentals] Add GitHub Secret Scanning details to token formats page #29715

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions src/content/docs/fundamentals/api/get-started/token-formats.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,9 +18,14 @@ Existing tokens continue to work. Every new token you create or [roll](/fundamen

## Leaked token detection

The prefixed format and checksum allow credential scanning tools to detect leaked Cloudflare tokens with high confidence. Cloudflare partners with scanning providers to find your tokens before they can be used maliciously.
The prefixed format and checksum allow credential scanning tools to detect leaked Cloudflare tokens with high confidence. Cloudflare partners with credential scanning providers to proactively find your leaked tokens and revoke them before they can be used maliciously.

When a leaked token is detected, Cloudflare automatically revokes it and sends an email to the token owner so you can generate a replacement.
### GitHub Secret Scanning

Cloudflare participates in [GitHub's Secret Scanning program](https://docs.github.com/en/code-security/secret-scanning/introduction/about-secret-scanning). GitHub scans every commit for Cloudflare API credentials in both public and private repositories.

- **Public repositories** — When GitHub detects a leaked Cloudflare token, it verifies the token using the checksum and sends Cloudflare a webhook. Cloudflare automatically revokes the token and notifies you by email so you can generate a replacement.
- **Private repositories** — GitHub notifies you about any leaked Cloudflare tokens so you can rotate them.

## Pre-2026 formats

Expand Down
Loading