Question

Your organization uses an internal service that issues API tokens in the format 'ACME-' followed by exactly 32 hexadecimal characters. These tokens are not detected by GitHub's built-in secret scanning patterns. As a security admin, you want secret scanning to detect these tokens across all repositories, and you want to see which existing tokens would be flagged before the pattern goes live. What should you do?

Accepted Answer

Create a custom secret pattern at the organization level with a regular expression matching the token format, and use the dry run feature before publishing it.

Answer

Open a support ticket asking GitHub to add the ACME token format to its default set of provider patterns for your organization.

Answer

Enable push protection at the organization level, which will automatically learn and block any recurring high-entropy string like the ACME tokens.

Answer

Add each known ACME token to the secret scanning exclusion list so that scanning can validate the pattern against them.