Question

Your security team enables secret scanning across all organization repositories in GitHub Enterprise Cloud. They receive hundreds of alerts and want to focus first on credentials that are confirmed to still be usable by an attacker, rather than expired or revoked tokens. Which secret scanning capability should they enable to help them prioritize alerts this way?

Accepted Answer

Validity checks (secret validity status), which query the token issuer to report whether detected secrets are active or inactive

Answer

Push protection, so that only active secrets are ever committed to the default branch

Answer

Custom patterns with a dry run, to reduce the total number of detected secrets

Answer

Dependabot alerts, which correlate leaked secrets with vulnerable dependencies