Question

A platform team wants to detect an internally issued API token that always looks like 'ACME_' followed by exactly 32 hexadecimal characters, but only when the token is immediately preceded by a quotation mark and followed by a semicolon in configuration files. They are authoring a custom secret pattern in the organization's security settings. Which combination of custom pattern fields should they use to most precisely match the token while avoiding false positives from surrounding text?

Accepted Answer

Use the 'Secret format' field for 'ACME_[0-9a-fA-F]{32}', the 'Before secret' field for the quotation mark, and the 'After secret' field for the semicolon.

Answer

Put the entire expression, including the quotation mark and semicolon, in the 'Secret format' field so the whole string is captured as the secret.

Answer

Define only the 'Secret format' field with a broad pattern like 'ACME_.*' and rely on validity checks to filter out non-matching strings.

Answer

Enter the token regex in the 'After secret' field and leave 'Secret format' blank, since GitHub matches trailing context first.