Validity checks expand to AWS, Microsoft, Google, and Slack tokens
GitHub has extended its secret scanning validity checks beyond GitHub tokens to cover select token types from AWS, Microsoft, Google, and Slack. These providers account for some of the most frequently detected secret patterns across public repositories on the platform. The expansion builds on the validity check feature introduced earlier this year for GitHub tokens, which lets security teams see at a glance whether a detected credential is still active.
The checks are part of GitHub’s broader effort to reduce manual work during alert triage. Rather than guessing whether a leaked token is live, administrators and developers can review an alert and immediately see its status in the UI. That saves time when working through large backlogs of alerts, and it helps teams prioritize remediation on tokens that actually pose a risk.
GitHub plans to continue broadening validation coverage through its secret scanning partner program. The list of supported patterns will be updated as new token types become eligible for validation.
Enabling validity checks
Organization owners, enterprise owners, and repository administrators can turn on the feature from “Settings” under “Code security and analysis.” In the “Secret scanning” section, select “Automatically verify if a secret is valid by sending it to the relevant partner.” Once enabled, the setting applies to non-GitHub tokens.
After activation, each alert shows whether the associated token is active. GitHub performs the validity checks periodically in the background. A manual “Verify secret” button in the alert view also lets you trigger an immediate re-check.
The validity status is meant to be one more signal in the alert investigation workflow, alongside the other context GitHub provides. For teams managing many alerts, the feature should make triage and follow-up faster. Feedback can be shared in the Code Security community discussion, and more details are available in the documentation.
