Configure and use Secret Protection

A platform team at a fintech company maintains a monorepo with a large `docs/examples/` folder containing sample configuration files that intentionally include obviously fake, non-functional API tokens for tutorials. These sample files repeatedly trigger Secret Protection alerts, creating triage noise for the security team. The team wants GitHub to stop scanning that specific directory for secrets going forward, while continuing full scanning everywhere else in the repository. What is the most appropriate way to achieve this?

You administer Secret Protection for an organization's private repository. The security team complains that when new secret scanning alerts are created, the right people are not being notified quickly enough. You want to ensure that a specific group of security engineers automatically receives notifications for newly detected secret scanning alerts in this repository, without granting them full admin rights. Which action correctly achieves this?

At Meridian Logistics, the security engineering team wants a specific individual to create and publish a new organization-level custom secret pattern that will apply across all repositories. The company follows least-privilege principles and does not want to grant broader administrative rights than necessary. Which role must this individual hold to define and publish an organization-wide custom secret pattern?

Your security team created a custom secret pattern to detect your company's proprietary API tokens (format: ACME-[A-Z0-9]{32}). After the pattern was validated with a dry run and published across the organization, developers report that these tokens are still being committed and appear only as retroactive alerts, never blocked at commit time. What must the team do so that these custom-pattern tokens are blocked before they enter the repository?

A platform team wants to detect an internally issued API token that always looks like 'ACME_' followed by exactly 32 hexadecimal characters, but only when the token is immediately preceded by a quotation mark and followed by a semicolon in configuration files. They are authoring a custom secret pattern in the organization's security settings. Which combination of custom pattern fields should they use to most precisely match the token while avoiding false positives from surrounding text?

Your organization uses an internal service that issues API tokens in the format 'ACME-' followed by exactly 32 hexadecimal characters. These tokens are not detected by GitHub's built-in secret scanning patterns. As a security admin, you want secret scanning to detect these tokens across all repositories, and you want to see which existing tokens would be flagged before the pattern goes live. What should you do?

Your organization uses an internally developed authentication service that issues tokens in a proprietary format (prefix 'intauth_' followed by 40 hex characters). A security engineer wants Secret Protection to detect these tokens across every repository in the organization, both existing and newly created, without configuring each repository individually. Which approach correctly achieves this?

Your security team has created a custom secret pattern to detect internal API tokens used by a proprietary microservice. After the pattern is enabled and detecting secrets across the organization, a security engineer asks whether Secret Protection can automatically confirm which detected tokens are still live (active) so the team can prioritize rotating those first. What should you tell them about validity checks for this custom pattern?

Your organization has enabled Push Protection with a delegated bypass policy. A developer without bypass privileges attempts to push a commit that contains a secret matching a supported pattern. According to the delegated bypass workflow, what happens next?

You are a repository administrator for a private repository in an organization that has a GitHub Advanced Security / Secret Protection license available but not yet enabled everywhere. Developers keep asking why they aren't getting warnings when they try to push AWS keys. You navigate to the repository's Settings > Advanced Security to turn on the protection. Which sequence correctly reflects the dependency you must satisfy before push protection can be enabled for this private repository?

A developer at your company accidentally commits an AWS access key to a public repository owned by your organization. Your team has NOT explicitly enabled any secret scanning features on this public repo. Which statement best describes what happens automatically with respect to this exposed credential?

A security engineer enables Push Protection on a repository that already contains committed secrets in its Git history. A developer then attempts to push a new commit that introduces an AWS access key. Separately, the team wants the previously committed secrets in the older commits to be surfaced. What will happen in each case?

A developer at your company is pushing a commit to a private repository that has Push Protection enabled. The push is blocked because GitHub detected a string that matches a known secret provider pattern. The developer insists the value is a fake, non-functional API key used only in a mocked unit test and is not a real credential. According to GitHub best practices, what is the MOST appropriate way for the developer to proceed so the push succeeds while maintaining a proper audit trail?

A developer at your company attempts to push a commit that contains what GitHub identifies as a valid cloud provider access key. Push Protection blocks the push. The developer is under deadline pressure and is certain the string is a placeholder used only in a local test fixture. As the security lead, what is the correct guidance for the developer to proceed while preserving your team's ability to review the decision later?

You are the organization security admin for a company with 300 existing repositories and dozens of new repositories created each month. Leadership wants push protection to automatically apply to every repository going forward, including any repo created after today, without requiring an engineer to toggle a setting per repo. Which action best achieves this goal?

A security engineer at your company discovers that a valid AWS access key was committed months ago and triggered a secret scanning alert. They immediately revoke the key in AWS, rotate credentials, and mark the alert as 'Revoked' in GitHub. Two weeks later, an automated audit shows the same secret string still exists in the repository's Git history on the default branch. What is the correct understanding of the alert's state and the appropriate next action?

Your organization has enabled Secret Protection with Push Protection across all repositories. Leadership wants to reduce the frequency of developers bypassing Push Protection blocks, but still allow a small trusted group to bypass when there is a legitimate business need (for example, committing a documented test placeholder). As the security admin, which configuration best achieves this control?

A startup maintains several open-source projects in public repositories under a free GitHub organization plan. The security lead wants to detect and block leaked credentials in these public repos but has no GitHub Advanced Security or GitHub Secret Protection license. Which statement accurately describes what secret scanning capability the team can use at no additional cost?

A security engineer wants GitHub to automatically verify whether detected secrets are still active by sending them to the relevant service provider, so triage can prioritize live credentials. The organization already has Secret Protection enabled across its repositories. What must the engineer do to make these automatic validity checks work?

A security engineer at a fintech company notices that Secret Protection alerts are being generated repeatedly for fake, non-functional API keys committed intentionally inside a `tests/fixtures/` directory used for unit testing. These placeholder values are not real credentials, and the noise is overwhelming the triage queue. The engineer wants to stop future scanning of that specific directory across the repository while still scanning all other paths. What is the recommended way to accomplish this?