Effective Date: March 17, 2026
1. Definitions
"Affiliate" means, with respect to a party, any entity that directly or indirectly controls, is controlled by, or is under common control with that party, where "control" means ownership of more than 50% of the voting securities or equivalent ownership interest.
"Detected Credential" means a token, key, password, or other authentication credential that GitHub's secret scanning functionality identifies in content hosted on the GitHub platform as matching a pattern associated with Partner's services.
"Detection Notification" means the event of GitHub transmitting Match Data to the Partner Endpoint. Each Detection Notification includes the Match Data transmitted as part of that event. Obligations that apply to Match Data under this agreement also apply to Match Data received through a Detection Notification.
"Feedback Data" means any information that Partner provides or makes available to GitHub in connection with the Program, including: (a) classification of each Detected Credential as a true positive, false positive, or indeterminate; (b) remediation actions taken by Partner in response to a Detection Notification, including revocation, rotation, quarantine, or end-user notification; (c) response-time metrics between GitHub's transmission of a Detection Notification and Partner's completion of remediation; and (d) overall performance feedback limited to Partner's experience with the Program.
"GitHub Marks" means trademarks, service marks, trade names, logos, and other brand identifiers owned or controlled by GitHub, Inc. or its affiliates.
"GitHub Metadata" means the URL, source, and type fields contained in Match Data.
"Match Data" means the data elements that GitHub transmits to the Partner Endpoint when GitHub identifies a Detected Credential, including: (a) the Detected Credential value; (b) the credential type identifier; (c) the URL where the Detected Credential was found (which may be empty); and (d) the source type, as described in the Program Documentation.
"Microsoft NDA" means the nondisclosure agreement in effect between Partner and Microsoft Corporation or its affiliates.
"Onboarding Materials" means the test-account credentials, Partner Endpoint URLs, and other configuration data that Partner provides to GitHub to enable participation in the Program. Onboarding Materials are not Token Patterns.
"Partner" means the entity or individual accepting this agreement.
"Partner Endpoint" means the public, internet-accessible endpoint that Partner designates to receive Match Data from GitHub.
"Program" means the GitHub Secret Scanning Partner Program.
"Program Documentation" means GitHub's published documentation for the Program, currently available at https://docs.github.com/code-security/secret-scanning/secret-scanning-partner-program, as GitHub may update it.
"Token Patterns" means the technical specifications that Partner provides to GitHub for use in the Program, including: (a) a unique, human-readable name for each credential type; (b) regular expressions and multi-part relationship rules that identify the credential type; (c) post-processing logic, exclusion patterns, validation endpoints, and format documentation; and (d) any other technical information that Partner provides to GitHub in connection with the Program's pattern-matching functionality.
"Detection Samples" means test materials that Partner provides to GitHub for building, testing, and validating Token Patterns, including (a) revoked, expired, or otherwise invalidated credentials; (b) credentials that Partner generates for testing purposes; and (c) any accompanying documentation or metadata that Partner provides with such credentials. GitHub may retain Detection Samples for the duration of the Program and for a period of 12 months following termination for archival and regression-testing purposes.
2. License
2.1 Ownership
As between the parties, Partner retains all right, title, and interest in and to the Token Patterns.
2.2 Token Patterns License
(a) Grant. Partner grants GitHub a non-exclusive, perpetual, irrevocable, worldwide, royalty-free license to use, reproduce, modify, create derivative works and distribute the Token Patterns for any purpose related to security scanning, secret detection, or credential protection, whether within the Program or in other GitHub products and services. GitHub may sublicense the foregoing rights only to GitHub's affiliates and to service providers acting on GitHub's behalf, provided that each sublicensee is bound by confidentiality and use restrictions at least as protective as those in this agreement.
(b) Open-Source Distribution. GitHub may publicly distribute software that incorporates Token Patterns under the MIT License or any other open-source license approved by the Open-Source Initiative. Partner acknowledges that, once distributed under an open-source license, Token Patterns incorporated in that software are governed by that license's terms and are not subject to recall or revocation.
(c) Survival. The license granted in this Section 2.2 survives expiration or termination of this agreement for any reason.
2.3 Onboarding Materials License
Partner grants GitHub a non-exclusive, worldwide, royalty-free license to use, reproduce, and display the Onboarding Materials solely to enable and operate the Program. This license terminates 30 days after expiration or termination of this agreement. During that 30-day period, GitHub shall use commercially reasonable efforts to cease active use of the Onboarding Materials but is not required to purge incidental copies retained in backups, caches, or archived records.
2.4 Feedback Data License
Partner grants GitHub a non-exclusive, perpetual, irrevocable, worldwide, royalty-free, fully sublicensable license to use, reproduce, modify, aggregate, analyze, and create derivative works of Feedback Data for any purpose related to developing, operating, and improving GitHub's products and services. This license survives expiration or termination of this agreement.
2.5 Detection Samples License
Partner grants GitHub a non-exclusive, worldwide, royalty-free license to use and reproduce Detection Samples solely for building, testing, and validating Token Patterns during the term of this agreement and for 12 months following termination.
2.6 Partner Representations
Partner represents and warrants that:
(a) Partner owns or has sufficient rights in the Token Patterns to grant the licenses in this Section 2;
(b) the Token Patterns do not, to Partner's knowledge, infringe any third party's intellectual property rights; and
(c) Partner has the authority to grant the licenses in this Section 2 without the consent of any third party.
2.7 No Revocation
The licenses granted in Sections 2.2 and 2.4 are irrevocable and are not subject to revocation for any reason, including termination of this agreement or any breach by GitHub. Partner's remedies for GitHub's breach of this agreement are limited to those set forth in Sections 13, 15, and 16.
3. Operational Requirements for Partner Endpoint
3.1 Partner Endpoint Performance
Partner shall ensure that the Partner Endpoint:
(a) returns an HTTP 2xx status code within 15 seconds of receiving a Match Data transmission, confirming receipt;
(b) does not rate-limit or reject GitHub webhook traffic below the volume thresholds specified in the Program Documentation;
(c) uses commercially reasonable efforts to maintain high availability of the Partner Endpoint;
(d) implements transport-layer encryption (TLS 1.2 or later) for all Match Data transmissions;
(e) does not throttle, block, or deprioritize GitHub webhook traffic relative to other inbound traffic of comparable volume; and
(f) validates the GitHub-Public-Key-Identifier and GitHub-Public-Key-Signature headers on every inbound request using the ECDSA-NIST-P256V1-SHA256 algorithm, as described in the Program Documentation.
If the Partner Endpoint fails to meet subsection (a) for five or more days in a calendar month, GitHub shall notify Partner, and Partner shall have 15 days to cure. If Partner fails to cure, GitHub may suspend Match Data transmission until Partner demonstrates compliance.
Partner shall maintain reasonable security measures for the Partner Endpoint, including access controls and encryption in transit.
3.2 Additional Endpoint Security
If Partner provides endpoints for credential validation, revocation, or enrichment, Partner shall:
(a) require authentication for all requests to such endpoints using credentials or certificates specified in the Program Documentation;
(b) encrypt all data in transit using TLS 1.2 or later;
(c) implement access controls that limit use of such endpoints to authorized GitHub systems; and
(d) notify GitHub promptly if Partner becomes aware of any unauthorized access to, or compromise of, such endpoints.
Data that GitHub receives from such endpoints is subject to the same purpose limitations, confidentiality obligations, and use restrictions that apply to Match Data under this agreement. GitHub shall not use such data for purposes beyond those specified in Sections 2.4 and 4.
4. Purpose Limitation on Match Data
4.1 Partner shall use Match Data only for the following purposes:
(a) verifying whether a Detected Credential is a valid credential on Partner's platform;
(b) revoking or quarantining Detected Credentials; and
(c) notifying the affected user or account holder on Partner's platform.
4.2 Partner shall not use Match Data for any other purpose, including:
(a) marketing or advertising;
(b) competitive intelligence;
(c) user profiling;
(d) using Match Data to infer or analyze behavioral patterns of GitHub users, repository populations, or ecosystem characteristics; or
(e) building databases of GitHub users who use Partner's service.
4.3 Private Repository Data
If Match Data originates from a private repository, Partner acknowledges that the data may be subject to additional legal requirements, including data protection agreements between GitHub and the repository owner. Partner shall apply the same or greater protections to private-repository Match Data as it applies to public-repository Match Data under this agreement.
5. Security
5.1 Partner shall maintain reasonable security measures for Partner Endpoint(s).
5.2 GitHub shall maintain commercially reasonable security measures to protect Token Patterns from unauthorized disclosure. This obligation does not apply to Token Patterns that GitHub has distributed under Section 2.2(b) or that are otherwise publicly available.
6. Confidentiality of Match Data
6.1 Partner shall treat Match Data as confidential information. Partner's obligations under this Section 6 apply in addition to, and not in place of, any obligations Partner may have under a Microsoft NDA (as defined in Section 1) or any successor nondisclosure agreement between Partner and Microsoft Corporation or its affiliates. If there is a conflict between this Section 6 and any such nondisclosure agreement regarding the treatment of Match Data, the more restrictive obligation governs.
6.2 Partner acknowledges that GitHub Metadata may reveal GitHub usernames, repository names, and file paths, and that aggregated Match Data (whether aggregated across multiple deliveries, users, or time periods) could reveal patterns about GitHub users. Partner shall take these risks into account when implementing its security and access-control measures under this agreement.
6.3 Partner shall not analyze or process Match Data for the purpose of identifying repository structures, file paths, secret-usage trends, or commit-level activity.
6.4 Breach Notification
Partner shall notify GitHub without undue delay, and in any event within 72 hours, upon becoming aware of any unauthorized access to, disclosure of, or loss of Match Data. The notification shall include, to the extent known: (a) the nature of the incident; (b) the categories and approximate volume of Match Data affected; and (c) the measures taken or proposed to mitigate the incident.
7. Data Retention and Deletion
7.1 Partner shall delete GitHub Metadata within 30 days after completing the validity check and any resulting revocation or notification actions under Section 4.
7.2 Section 7.1 does not apply to the Detected Credential value, including all components of a multi-part credential. These values are Partner's own customer credentials, and Partner's own data-retention policies govern retention of those values.
8. No Onward Sharing
8.1 Partner shall not disclose, forward, or otherwise make available Match Data to any third party, including Partner's affiliates, vendors, or subcontractors.
8.2 Section 8.1 does not prohibit Partner from disclosing Match Data if required by applicable law, if Partner:
(a) notifies GitHub in advance of the required disclosure to the extent permitted by law; and
(b) discloses only the minimum information legally required.