Question

Your security team created a custom secret pattern to detect your company's proprietary API tokens (format: ACME-[A-Z0-9]{32}). After the pattern was validated with a dry run and published across the organization, developers report that these tokens are still being committed and appear only as retroactive alerts, never blocked at commit time. What must the team do so that these custom-pattern tokens are blocked before they enter the repository?

Accepted Answer

Enable push protection for the custom pattern, which is a separate opt-in setting that must be turned on after the pattern is published

Answer

Re-run the dry run in enforcement mode, which automatically converts detection alerts into push blocks

Answer

Lower the alert threshold so high-confidence custom matches are automatically escalated to push protection

Answer

Add the custom pattern to the list of partner patterns so GitHub's validity service can block it at push time