Question

A platform engineering team at a mid-sized company uses Secret Protection across all private repositories. During a review, a security analyst notices that GitHub automatically flagged an exposed cloud provider API token in one repo, but a hardcoded internal database password used by the same application was never detected by secret scanning. The internal password does not match any known provider format. What is the MOST appropriate action to ensure this type of internal credential is detected going forward?

Accepted Answer

Create a custom secret pattern with a regular expression that matches the internal password format, then enable it for the relevant repositories or organization

Answer

Enable push protection on the repository, which will retroactively scan and detect all previously committed non-provider secrets

Answer

Request that GitHub add the internal password format to its partner secret provider program so it is scanned by default

Answer

Turn on validity checks, which automatically expands scanning coverage to include internal and non-standard credential formats