Question

A security engineer is reviewing the secret scanning alerts for a private repository that has GitHub Secret Protection enabled. Among dozens of alerts, one for an AWS access key is flagged with a label indicating the secret is confirmed to be live and usable, and it is surfaced near the top of the alert list. The engineer wants to understand what capability produced this label and prioritized ordering. Which Secret Protection feature is responsible for this behavior?

Accepted Answer

Validity checks, which query the token issuer's API to determine whether the credential is still active and prioritize high-confidence alerts

Answer

Push protection, which blocks the commit and marks the secret as active before it reaches the default branch

Answer

Custom secret patterns, which apply a confidence score to any regex-matched string in the repository

Answer

Delegated bypass policies, which escalate alerts for credentials that were pushed despite a bypass request