This ESQuery-based rule detects a GitHub secret-scanning alert that GitHub has marked as publicly leaked (github.publicly_leaked == true). It filters for event action secret_scanning_alert.create within the GitHub audit logs (logs-github.audit-*), gating on the publicly_leaked flag to reduce noise from dummy/test data. A publicly leaked credential means the secret was exposed outside the repository’s access boundary (e.g., in a public repo or public gist), representing a confirmed credential compromise and requiring immediate rotation rather than treating it as a low-signal finding. The rule surfaces key context to aid triage: repository/org (github.repo, github.org), whether the secret was detected across multiple repos (github.multi_repo), type data for the secret (github.secret_type and github.secret_type_display_name), and the acting user (user.name) along with observables like github.actor_ip and github.user_agent. It also includes the hashed token (github.hashed_token) and the nature of access (github.programmatic_access_type). This supports rapid investigation of exposure scope and potential impact on production systems. MITRE ATT&CK alignment maps this to Unsecured Credentials (T1552), with the subtechnique Credentials In Files (T1552.001) under Credential Access (TA0006). False positives can occur when test/example tokens are publicly published; tuning should be done by repository, secret_type, or known test org. Recommended response is to revoke/rotate the exposed credential immediately, invalidate sessions/tokens derived from it, and remove the secret from git history if required by policy. The rule references GitHub’s secret-scanning guidance and is designed to drive prompt containment and credential hygiene.