GitHub secret scanning now spots Cloudflare Access service tokens

A machine token that reaches a Cloudflare-protected app can now be caught by GitHub before anyone else notices. GitHub says its secret scanner spots Cloudflare Access service tokens in both public and private repositories. If one lands in a public repo, GitHub tells Cloudflare.

GitHub added the detector on 12 November 2026. The changelog names the new secret type as cloudflare_access_service_token. The Secret Scanning Partner Program covers it. That means a public leak goes straight to Cloudflare. Cloudflare can then shut the token off at its end. The attacker never gets to use it.

What this guards

Cloudflare Access service tokens let a script or a server reach an app protected by Cloudflare Zero Trust. They sit in CI jobs, in cron tasks, and in machine users that talk to internal APIs. Each token is a pair: a Client ID and a Client Secret. Cloudflare's own docs say a secret is shown only once at creation.

Since August 2026, new secrets look like cfast_ plus 40 letters and digits, plus an 8-character check. Older secrets are 64 hex characters. Both still work. The Client ID stays the same across rotations, so an attacker needs the secret too.

A leaked secret lets a stranger reach whatever the token's policy allows. That is often an internal admin page, a staging API or a database tool. Scanning catches the file in the push. For public repos, GitHub also hands Cloudflare the fact that the secret has leaked.

What to do with it

For teams that use Cloudflare Access, this is a free second check. GitHub has it on by default on public repos. Private repos need the feature switched on in the security settings. Push protection, which blocks the commit before it lands, is a separate setting and is not part of this announcement.

The announcement says nothing about how cloudflare_access_service_token compares to other Cloudflare secrets GitHub already covers. API tokens are on that list too. The new detector is one more string on a list of hundreds of partner secret types.

For a team starting on Cloudflare Zero Trust, the cheapest fix for a leaked secret is to rotate the token. Move on and keep working. The new detector tells the team sooner. Turn on push protection in the repositories that handle tokens. The leak then never reaches main.

Source

Secret scanning adds a detector for Cloudflare, GitHub Changelog