Secret scanning webhook
GitHub's secret-scanning partner endpoint.
packages/api/src/webhooks/secret-scanning.controller.ts by packages/docs/tools/generate-reference.mjs. Every example is a real exchange recorded against the control plane by packages/api/src/testing/reference-examples.spec.ts, with ids from that run. Credentials in the formats this product issues (kr_, krsk_, krses_, JWTs) and values under credential-named fields (password, *_secret, *_token, *_key, lookup_hash) are elided at record time; the recorded file and every page of this site are swept for credential shapes (kr_, krsk_, krses_, JWTs, URLs carrying a password, password fields) before either is accepted. Do not edit by hand: src/reference.spec.ts regenerates it and fails on a difference.POST /v1/webhooks/github/secret_scanning -- GitHub's secret-scanning
partner endpoint (report section 8.2).
Several routes here are unauthenticated -- sign-up, log-in, the health
probes, the JWKS. This is the only one that revokes a credential without
holding one. What authorises it is the ECDSA signature over the raw body,
and that check runs before anything else: before the JSON is parsed,
before a token is hashed, before a connection is borrowed. The body reaches
this handler as a Buffer precisely so that is true rather than merely
intended -- app.factory.ts leaves this one route's payload unparsed, for
the same reason GitHub's own documentation gives (a re-serialised body has
different bytes and would not verify).
Every token is handled in its own transaction, so one that fails does not undo another's revocation, and a failure answers 5xx rather than labelling a token we did not act on -- GitHub redelivers, and every action here is idempotent.
POST /v1/webhooks/github/secret_scanning
Answers 200 on success.
Authentication.
- No credential.
Example.
curl https://keyring-api.belghalem.fr/v1/webhooks/github/secret_scanning \
-X POST \
-H "Github-Public-Key-Identifier: $GITHUB_KEY_IDENTIFIER" \
-H "Github-Public-Key-Signature: $GITHUB_SIGNATURE" \
-H "Content-Type: application/json" \
-d '[
{
"token": "kr_test_KVME4u…",
"type": "keyring_api_key",
"url": "https://github.com/acme/payments/blob/1234567890abcdef1234567890abcdef12345678/.env",
"source": "content"
}
]'HTTP/1.1 200 OK
Content-Type: application/json
[
{
"token_hash": "b9b8b3923b698f01341c8ebba34e136c6dfa97f15ff30116af86809079263a69",
"token_type": "keyring_api_key",
"label": "true_positive"
}
]