Skip to content
NewsProduct launch

GitHub adds SpaceX to its secret-scanning partner program for leaked Starlink keys

· by

The short version

GitHub now auto-forwards exposed Starlink public API v2 credentials to SpaceX for revocation, and tightened false-positive filtering on six other cloud detectors, per GitHub's November 5 changelog.

GitHub adds SpaceX to its secret-scanning partner program for leaked Starlink keys

A credential that used to just trip an alert now gets acted on automatically: GitHub's secret-scanning partnership program added SpaceX on November 5, 2026, so a leaked Starlink key in a public repo gets forwarded straight to SpaceX for revocation, per GitHub's changelog post.

What changed

GitHub's secret-scanning partnership program now covers a new starlink_public_api_v2_secret detector tied to SpaceX, per the changelog. Under that program, when GitHub finds a partner's secret type exposed in a public repository, it automatically reports the finding to the partner so the credential can be revoked or rotated before anyone abuses it, rather than only generating an alert for the repository owner. That auto-forward is reserved for "partner" secret types; GitHub's broader "user" secret detectors still just raise an alert, whether the repo is public or private, per the same post.

The same release tightened false-positive filtering on six already-supported providers: Alibaba, AWS, Google, OpenVSX, Pydantic Services, and Tencent. For AWS alone the fix touches three separate detectors (access key IDs, session tokens, and temporary access key IDs). The fix suppresses an "unpaired match," meaning GitHub no longer flags a lone credential fragment once its companion secret has already been filtered out by the scanner's own dictionary checks, per the changelog.

A rocket company now sits next to the cloud majors in GitHub's alert pipeline

SpaceX joins a partner list that is otherwise dominated by cloud and SaaS vendors (AWS, Google, Alibaba, Tencent, and others already auto-report through the same mechanism). That puts an aerospace company's developer-facing API credentials on the same automated revocation path as a hyperscaler's cloud keys, a sign that GitHub is willing to extend the program past its historic cloud/SaaS scope as more companies expose public APIs through developer accounts. For teams building on Starlink's public API, the practical change is speed: a key accidentally committed to a public repo should now get flagged to SpaceX directly, cutting the window between exposure and rotation instead of relying on the repo owner to notice GitHub's alert first.

The six-detector tightening matters for a different group: anyone who has had AWS, Google, Alibaba, or Tencent credential alerts fire on code that was never actually a live secret. Those false positives create alert fatigue that makes real leaks easier to miss, so narrowing the match criteria should cut noise for teams running the AWS and Google detectors in particular, where multiple secret-type variants were patched in this single release.

What to watch next

Whether GitHub adds more aerospace, defense, or infrastructure vendors to the partner list in the months after SpaceX, which would confirm the program is moving past its cloud/SaaS-credential roots rather than making a one-off exception.

Sources