Question

Your security team has created a custom secret pattern to detect internal API tokens used by a proprietary microservice. After the pattern is enabled and detecting secrets across the organization, a security engineer asks whether Secret Protection can automatically confirm which detected tokens are still live (active) so the team can prioritize rotating those first. What should you tell them about validity checks for this custom pattern?

Accepted Answer

Validity checks are not automatically available for custom patterns; automatic verification of whether a secret is active is only supported for secret types with a validator built by GitHub or a partner, though you can enable validity checks that use the partner-supported infrastructure for supported providers.

Answer

Validity checks run automatically for every custom pattern as soon as it is enabled, so the team will see active/inactive status for all detected internal tokens without any additional configuration.

Answer

Validity checks for custom patterns require the team to upload the token's revocation endpoint URL, after which GitHub will call it hourly to confirm each secret's status.

Answer

Validity checks are never available in Secret Protection; the team must build a scheduled GitHub Actions workflow to test each detected token against the microservice.