Security teams that pipe GitHub audit logs into a SIEM have until Nov. 12 to check their filters. On that date, the business field in secret_scanning_alert.* and secret_scanning_push_protection.bypass events will switch from the enterprise display name to the enterprise slug, GitHub said in a changelog update.

Integrations that match on the display name will stop matching. GitHub’s advice is to make them accept both formats before the rollout or filter on business_id, which does not change. The field stays a string, and event names are the same.

The same post, published Tuesday, also lists smaller fixes. In private and internal repositories on github.com, the revocation action for leaked tokens, still in public preview, now handles Base64-encoded classic and fine-grained personal access tokens, OAuth access tokens and GitHub App user access tokens. GitHub decodes the value itself. Leaked credentials were at the center of the GhostAction attack WebProNews covered this week.

Open alerts on an edited custom pattern now stay open if a rescan finds they still match, instead of closing and reopening. The Request pending status on an alert can now take keyboard focus without triggering an action, and the revocation flow announces its progress to screen readers. Dismissal-request webhook payloads gain an exemption_request.number field for matching requests across tools.

For anyone scripting against the custom pattern API, requests the scanning service rejects for invalid arguments now return a 422 error instead of a 500, so integrations can tell bad input from a server failure.

Source: GitHub Changelog