Secret Scan Sweep

Overview

A weekly scheduled Power Automate cloud flow that scans every repository in a configurable GitHub organization for risky secret-leak patterns (e.g., AKIA, password=, private_key, BEGIN RSA PRIVATE KEY, Slack bot tokens, api_key=, client_secret=), logs each match to a Dataverse table, and emails the security team an HTML summary table with direct links for triage.

The flow is a complete reference implementation. It ships in the Off state — turning it on requires only (a) authorizing the GitHub PAT and Office 365 + Dataverse connections in the default environment, and (b) setting the four environment variables listed below.

Use Case

Continuous, low-touch secret-leak auditing for a GitHub organization — without the cost or procurement delay of a dedicated secret-scanning SaaS. Ideal for small-to-mid security teams who need an auditable log of pattern matches in Dataverse plus a weekly digest in Outlook.

The flow is ideal for teams that:

• Small-to-mid security teams needing an auditable log of pattern matches in Dataverse
• Organizations wanting a weekly digest of potential secret leaks in Outlook
• Teams looking to avoid the cost or procurement delay of a dedicated secret-scanning SaaS

Flow Architecture

Environment Variables

Connectors & Connections

Connector	API name	Actions used
Microsoft Dataverse	shared_commondataserviceforapps	CreateRecord (Creates a row in flowlibs_secretscanhits for each match)
Office 365 Outlook	shared_office365	SendEmailV2 (Weekly summary email to the security team)
HHTTP (built-in)	http	GET https://api.github.com/search/code (Authed via PAT header; built-in fallback (no native GitHub code-search operation))

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Narrow or expand the scan

Edit flowlibs_SecretScanPatterns. Add project-specific markers (e.g., company API-key prefixes like int_, sk_live_, GitHub app private-key markers) or remove ones that produce too much noise. Patterns are matched exactly as provided, with commas as the only separator.

Change the cadence

Edit the Recurrence trigger. Daily works well for fast-moving orgs; weekly is the default to keep the signal-to-noise ratio manageable.

Switch recipient

Edit flowlibs_SecurityTeamEmail. For a distribution list, use the group's SMTP address.

Additional downstream routing

Insert a Condition after the summary email that checks @greater(variables('varTotalHits'), 0) and triggers a Teams message to a Security channel or a Dataverse-backed incident record in high-hit scenarios.

Retain history trimming

Add a monthly cleanup flow that queries flowlibs_secretscanhits with scandate lt {n} days ago and deletes stale rows via shared_commondataserviceforapps/DeleteRecord, if regulatory retention permits.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

@guid()

@split(variables('varSecretScanPatterns'), ',')

@{concat('https://api.github.com/search/code?per_page=30&q=', encodeUriComponent(trim(items('For_Each_Pattern'))), '+org:', variables('varGitHubOrg'))}

@{concat('Bearer ', variables('varGitHubPAT'))}

@coalesce(body('Parse_Code_Search_Response')?['items'], createArray())

@if(greater(variables('varTotalHits'),0), '#B00020', '#008000')

Customize & download