Prioritizing leaked GitHub tokens by their current state
When secret scanning flags a leaked credential, the immediate question is whether that token is still live — and if so, what damage it could do. Validity checks for GitHub tokens now answer that question directly inside the alert.
The check determines whether a token is currently active and, where detection is reliable, whether it has ever been active. That distinction matters during remediation triage: a live token warrants urgent rotation, while an already-revoked one can be deprioritized while you review logs for any unauthorized use that may have occurred in the meantime.
For a leaked GitHub token, the alert will state plainly whether the secret is still valid. In cases where accuracy can't be guaranteed — for example, when a token discovered on GitHub.com actually belongs to a GitHub Enterprise Server deployment — the alert instead points you toward the right place to carry out remediation.
What's on the roadmap
Support is expanding soon to validate secrets belonging to the 100+ secret scanning partners. In the meantime, more details on securing repositories with secret scanning are available in the official documentation.
