New Feature: Automatically Detect and Mitigate Valid Base64 Encoded GitHub Personal Access Tokens

We are excited to introduce a powerful enhancement to Arnica's Secrets Scanning capabilities: automatic detection, validation and mitigation of Base64 encoded GitHub personal access tokens. This latest update ensures that even encoded secrets, often used to bypass standard security scanners, are instantly identified, validated, and mitigated—without disrupting developer workflows.

Why It Matters

Developers sometimes encode secrets to evade basic security checks, either inadvertently or as a shortcut to keep moving quickly. However, even encoded secrets pose a significant security risk when committed to Git repositories. With this enhancement, Arnica can now:  

• Detect Base64-encoded GitHub Classic and Fine-Grained Personal Access Tokens hidden in code, preventing accidental exposure.
• Decode and validate tokens automatically to confirm their authenticity.
• Determine the severity level based on the context of the token. For example, a token with admin permissions is classified with high severity, while a lower privileged token presents lower severities.
• Mitigate pushed secrets immediately, ensuring they don’t remain in your git history.
• Alert security teams, providing full visibility into attempted bypasses while preventing security incidents.

What Sets Arnica Secrets Scanning Apart

This enhancement extends our existing secrets detection and automatic remediation capabilities. Arnica's real-time mitigation ensures that even if an encoded secret makes it past initial checks, it is swiftly removed—without penalizing developers. Security teams gain valuable insights while maintaining compliance with company policies.

Seamless Protection, Zero Disruptions

For developers, this means no workflow interruptions—just peace of mind knowing that even if a secret is accidentally encoded and pushed, Arnica has it covered. For security teams, it means stronger compliance, fewer risks, and improved visibility into potential security workarounds.

This is another step in our mission to provide frictionless, automated security that protects your code while keeping developers focused on building great software.

🚀 Already using Arnica? This enhancement is live—no extra configuration required!
💡 New to Arnica? Get in touch today to see how our intelligent security automation can protect your repositories without slowing you down.

‍