What is the 'secret scanning' custom patterns feature in GitHub Advanced Security?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Custom patterns in GHAS secret scanning let you teach GitHub to recognize your own secret formats. If your company uses API tokens with a specific prefix pattern that GitHub doesn't know about by default, you write a regex and GitHub starts hunting for it.
Full explanation below image
![Educational infographic showing GitHub secret scanning custom patterns. Display a custom pattern creation panel: pattern name, regex input field, test string validation. Show example: company API key pattern ^MYCO-[A-Z0-9]{32}$ matched against a test string. Show alert generated when pattern matched in repository code. Compare default patterns (GitHub-built-in: AWS, Google, Stripe) vs custom patterns (org-specific formats). Include enterprise-level pattern that applies to all org repos. Purple GHAS branding with regex pattern visualization. 1024x768 pixels.](/media/github/gh-100/GH-100-q118-infographic.webp)
Full Explanation
GitHub Advanced Security's secret scanning custom patterns feature allows organizations and enterprises to define their own regular expression patterns to detect proprietary or internal secret formats not covered by GitHub's built-in patterns. Configuration: (1) Administrators create custom patterns by providing a regex pattern, optional test strings, and a descriptive name. (2) Patterns can be defined at the repository, organization, or enterprise level. (3) Custom patterns can be tested against sample strings before deployment. (4) When a match is found, it generates a secret scanning alert like built-in patterns. Use cases: internal API keys with company-specific prefixes, database connection strings in proprietary formats, custom token schemes, or any credential format unique to the organization's systems. Custom patterns combined with push protection provide comprehensive coverage for organization-specific secrets.