Secret scanning: push protection and a history scan issue #268 closed: completed andymccall opened this 16 days ago · 0 comments

From the competitor comparison (2026-10-19): GitHub (push protection, Advanced Security), GitLab (Ultimate) and Bitbucket (paid) scan for secrets; OxygenHub does not.

Goal: a credential never reaches a repository on the hub unnoticed.

• Push protection: the hub scans what a push adds (new text in changes) for credentials: cloud keys (AWS, GCP service account JSON, Azure), hub and GitHub/GitLab tokens, private keys (PEM, OpenSSH), Slack/Stripe-style tokens, high-entropy assignments to names like *_SECRET/*_TOKEN. A hit refuses the push with the file, line and kind, and how to remove it (oxy amend, oxy abandon).
• Reviewed bypass: a maintainer can allow one finding (false positive, test fixture) with a reason; audited, on the push log. Per-repository setting to turn push protection off (on by default for new repositories?).
• History scan: a background scan of existing history per repository, with findings on a Security tab (who can see: admins/maintainers), and a way to mark resolved/revoked.
• Agents: a refused push from an agent says so in terms an agent can act on.
• Patterns as data (a versioned rules file), not code; the hub's own tokens (oxyhub_…) also revoked on detection.

Open: where the scanner runs (in the push path, budgeted, vs. after acceptance with quarantine); whether runners scan too.