GitHub secret scanning adds Lovable, Pydantic and Supabase token detectors

GitHub has expanded secret scanning with detectors for Lovable Labs, Pydantic Services and Supabase credentials, giving developers more automatic coverage for tokens that can leak into repositories. The October 5 changelog says the new coverage includes Lovable API keys, Pydantic Logfire tokens, Pydantic AI Gateway API keys, Supabase OAuth access tokens and Supabase scoped personal access tokens.

The most important operational change is not just another pattern in a scanner. Lovable Labs has joined GitHub's secret scanning partnership program. When a supported partner secret is found in a public repository, GitHub says it forwards the finding to the issuer so the credential can be revoked or rotated before it is abused. That makes the alert path faster for a class of mistakes that often happens during prototyping, demos or rushed deployment work.

Why this matters for developer teams

The update lands in a software stack where more teams are building AI enabled apps with hosted databases, observability services and low code front ends. Those workflows often create service tokens early in a project, before teams have mature environment management, branch protections or review habits in place. A leaked Supabase OAuth token or AI gateway key can expose more than a single test script if it reaches a public repository.

GitHub separates partner secrets from user secrets in the announcement. Partner secrets can be reported to the issuer when detected in public repositories. User secrets create GitHub secret scanning alerts when found in public or private repositories. That distinction matters for response planning because not every alert has the same automatic remediation path. Security teams should still confirm whether a provider revokes the token, whether downstream credentials need rotation and whether logs show actual use.

What to watch next

The practical CyberOGZ read is simple: detector coverage is becoming a moving target. Teams that rely on GitHub Advanced Security or repository level secret scanning should treat this as a reason to review alert routing, not as a reason to relax. The highest value move is to connect alerts to an owner who can rotate credentials quickly, then remove old tokens from documentation, sample apps and local setup guides.

For teams adopting tools like Lovable, Supabase or Pydantic AI services, this also creates a useful procurement question. Ask vendors how leaked keys are reported, how quickly they can be revoked and whether scoped tokens can limit damage before a mistake happens.

Sources

• github.blog

Cover photo by Christina Morillo on Pexels, used under the Pexels License.