Question

A security engineer wants GitHub to automatically verify whether detected secrets are still active by sending them to the relevant service provider, so triage can prioritize live credentials. The organization already has Secret Protection enabled across its repositories. What must the engineer do to make these automatic validity checks work?

Accepted Answer

Enable the 'Automatically verify if a secret is valid by sending it to the relevant partner' setting in the organization's Code security and analysis settings

Answer

Create a custom secret pattern with a validity endpoint regex for each partner service the organization uses

Answer

Enable Push Protection at the organization level, which performs validity checks before secrets are committed

Answer

Configure a branch protection rule that requires validity status checks to pass before merging