---
title: "GitHub secret scanning notifications now link to each detection location"
description: "When an exposed Cloudsmith API key is detected in a GitHub repository, the email notification sent to the affected Cloudsmith user and workspace owners now lists every location the key was found in GitHub, with a direct link to each detection."
canonical_url: "https://cloudsmith.com/changelog/github-secret-scanning-notifications-now-link-to-each-detection-location"
last_updated: "2026-09-11T16:25:15.290Z"
---
# GitHub secret scanning notifications now link to each detection location

When an exposed Cloudsmith API key is detected in a GitHub repository, the email notification sent to the affected Cloudsmith user and workspace owners now lists every location the key was found in GitHub, with a direct link to each detection.

The email groups detections by location:

- File contents and commits
- Issue titles, descriptions, and comments
- Pull request titles, descriptions, comments, and reviews
- Discussion titles, bodies, and comments
- Wiki commits

The Cloudsmith workspace audit log records an `API_KEY_EXPOSED` event for each detection, with the masked key and detection location.

Exposure detection for Cloudsmith API keys in GitHub runs through the [GitHub secret scanning partner program](/changelog/cloudsmith-api-keys-are-now-detectable-by-github-secret-scanning). For more details, see [GitHub secret scanning](https://docs.cloudsmith.com/supply-chain-security/github-secret-scanning) in the Cloudsmith documentation.