GitHub
Security & compliance
Code quality
Committed private key or certificate
Part of the Secret hygiene check · fix arrives as a guide
What it is
A private key or certificate — an SSH key, a TLS key, a service-account JSON — is committed to the repository.
Why it matters
A private key's only security property is that it stays private. In a repository it is available to every collaborator and to anyone who obtains a clone, and it usually authenticates to more than one system.
How to fix it
Revoke and reissue the key immediately, then remove it from the working tree and add the pattern to .gitignore. Store the replacement in a secret manager and inject it at deploy time.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.