About validity checks
Validity checks, a feature of secret scanning, verify whether a detected secret is still active and could be exploited. This helps you prioritize remediation by focusing first on secrets that are confirmed to be active.
You can enable automatic validity checks for detected secrets. Once enabled, GitHub will periodically check the validity of a detected credential by sending the secret to the issuer and testing it against APIs provided by that service. Validity checks are available for secrets from many service providers, and support continues to expand as GitHub partners with additional services.
GitHub prioritizes privacy when checking the validity of the credential. We typically make GET requests, pick the least intrusive endpoints, and select endpoints that don't return any personal information.
GitHub displays the validation status of the secret in the alert view, so you can see if the secret is active, inactive, or if the validation status is unknown. For most secrets, you can optionally perform an "on-demand" validity check for the secret in the alert view.
Getting started with validity checks
You can enable validity checks at the repository, organization, or enterprise level to help prioritize which exposed credentials pose the most immediate security risks.
For large organizations, we recommend using security configurations to enable these features at the organization or enterprise level. Security configurations allow you to centrally manage secret scanning settings and apply them consistently across many repositories.
To get started:
- For repositories, see Enabling validity checks for your repository
- For an organization, see Creating a custom security configuration
- For an enterprise, see Creating a custom security configuration for your enterprise