GitHub promotes gh-secure, a CLI security shortcut

The extension turns on five settings in public repositories. The October 1 post is not the launch.

On October 1, 2026, at 2:05 p.m. Brasília time, the @github account on X pointed to gh-secure. It is a GitHub CLI extension, an add-on to the terminal program gh, from GitHub Security Lab, the company’s security research team. The post says: “Just one command can help you stop leaking secrets into your public code.” The official account squeezed the pitch into one problem, leaks. The README describes five switches, one command.

The GitHubSecurityLab/gh-secure repository has existed since July 30, 2026. Tag v0.1.0 shipped on September 16 and, in an October 9 snapshot, was still marked a pre-release. If you keep public code on GitHub, this is a configuration shortcut, not a new scanner.

First: what this extension is

An extension adds commands to gh. This one adds gh secure. It switches on features GitHub already offers on public repositories.

A secret, here, is a key, token, or password that should not sit in the code. Push protection is a block at send time: if the platform recognizes a token pattern, the push is rejected. CodeQL is GitHub’s static analyzer, the program that looks for known flaws without running the code. Dependabot opens update pull requests when a library in the project has a security fix.

Security Lab is part of GitHub. The command turns on GitHub’s own products.

What gh-secure turns on

The README lists branch protection, private vulnerability reporting (a private channel to report a hole without a public issue), secret scanning with push protection, Dependabot, and code scanning with CodeQL.

Official install is gh extension install GitHubSecurityLab/gh-secure. You need an authenticated GitHub CLI and admin or maintainer access. You can run gh secure interactively, gh secure --yes with no prompts, gh secure status to check, and --dry-run to simulate. The same README says the flow also works in the Copilot app, Copilot CLI, or another AI assistant that can call the tool. The company describes the set as free for open source on public repositories. Pricing on private repos is not in that text.

The README slogan is “Protect your project in 2 minutes.” That is two minutes as stated by the vendor, with no independent timing.

Dates, not a launch

The initial commit is dated July 30, 2026, by xcorail (Xavier RENE-CORAIL, GitHub staff). Pre-release v0.1.0 was published by xcorail on September 16, 2026, at 21:02 on the clock shown on the releases page. The @github post does not use the word launch.

We did not find a GitHub Blog post devoted to the tool. On July 1, 2026, updated July 28, Joseph Katsioloudes listed six settings every maintainer should turn on. The CLI covers five. SECURITY.md, the file that explains how to report a problem, sits outside the feature list; the README flags it as a next step.

Limits, a test, and who it is for

The README says the tool does not change source code. Branch protection may require a pull request instead of a direct push. Dependabot opens PRs; a human still merges. Code scanning raises alerts and does not block merges unless that is configured separately. Settings can be reverted. The company also writes that no tool guarantees complete security. If a key already leaked, it still has to be revoked.

Around October 3, 2026, Yoshiyuki Watanabe described a Medium test on yowatanabe/netflix-intro-skipper. The CLI summary showed “5/5 features enabled”. Then gh secure status marked Secret Scanning Push Protection as “not enabled”. The security_and_analysis API showed secret_scanning and secret_scanning_push_protection disabled. He turned both on with gh api -X PATCH. That is an indication: one write-up, one repo. This newsroom did not rerun the test. RUMOR: that the mismatch was fixed in commits from October 1 and 2. Pull request #18, merged October 2, 2026, only covers repositories where the owner name matches the repo name.

It helps if you maintain a public repository and have admin or maintainer access. It does not revoke a leaked token, merge Dependabot PRs, or write SECURITY.md.

What we still do not know

On October 9, 2026 the releases page still marked v0.1.0 as Pre-release. This newsroom did not run the command. The shortcut exists, and the CLI can still claim it enabled something the API shows as off. Check with gh secure status.

Sources

Official

• GitHubSecurityLab/gh-secure
• gh-secure README
• Pre-release v0.1.0
• Initial commit, 30 Jul 2026
• @github on X, 1 Oct 2026
• GitHub Blog, Joseph Katsioloudes, 1 Jul 2026
• PR #18

Independent

• Yoshiyuki Watanabe, Medium