Demo GHAS Secret Scanning Custom Patterns

In this guide you’ll learn how to configure GitHub Secret Scanning to detect organization-specific or proprietary secrets that GHAS does not ship patterns for by default. We’ll use a small demo repository to illustrate creating, testing (dry run), and publishing an organization-level custom pattern that raises alerts when a matching secret is found.

Initial repository state (app.js)

Below is the sample app.js used in the demo. It contains several mock high-entropy secrets (AWS keys, a public PAT) and an internal ACME token that GitHub Secret Scanning will not detect until a custom pattern is added.

const express = require('express');
const path = require('path');
const app = express();
const PORT = process.env.PORT || 3000;

// ==============================================
// DEMO 1: Secret Scanning
// These are mock secrets for demo purposes.
// GitHub Secret Scanning will detect known patterns,
// but the internal ACME token is not known by default.
//
const AWS_ACCESS_KEY_ID = "AKIAIOSFODNN7EXAMPLE";
const AWS_SECRET_ACCESS_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY";

const GITHUB_PAT = "ghp_XXXXXXXXXXXXXXXXXXXX";

const acme_token = "ACME-12345678901234567890123456789012";

app.get('/', (req, res) => {
  res.send('GHAS Demo App is running.');
});

// ==============================================
// DEMO 2: CodeQL (Static Analysis / SAST)
// This endpoint takes unvalidated user input (req.query.file)
// and passes it directly to res.sendFile(), allowing path traversal.

If you push this commit to the main branch, GitHub will flag known secrets (like the AWS keys and public PAT). The acme_token above will not be flagged because its format is proprietary and not included in GitHub’s built-in detectors.

Create organization-level custom patterns when you want consistent detection rules across many repositories. Use repository-level patterns only for repository-specific cases or short-lived exceptions.

Repository-level vs Organization-level custom patterns

You can create custom secret-scanning patterns either per-repository or for the whole organization. The organization-level option is recommended when you need a single policy applied across your repositories.

Scope	When to use	Limit
Repository-level	Repo-specific rules or exceptions	Up to 100 custom patterns per repository
Organization-level	Single policy across many repos (recommended)	Up to 500 custom patterns per organization

Creating a custom pattern (example)

Navigate to your organization settings: Settings → Advanced Security → Global settings → Custom patterns For the ACME token in this demo, create a new custom pattern with these values:

Name: Acme
Regular expression: ACME-[A-Z0-9]{7}
Optionally: provide before/after context and a test string to validate the regex

Example test strings:

ACME Token
ACME-[A-Z0-9]{7}
ACME-9874561

Make sure your regex matches the actual format used by your internal tokens. You can refine the pattern with anchors, groups, or context if necessary.

Never commit or store real production secrets in source control for testing. Use mock secrets or redacted values when experimenting with secret-scanning features.

Dry run: initial result

Before publishing a pattern, run a dry run against up to 10 repositories from the UI to find existing matches. This helps you confirm detection without immediately creating alerts. Example dry run output from the demo (initial run):

Status: Completed
Repositories: 1
Total duration: 3s
Total matches: 0

Why zero matches? The acme_token in the repository was originally much longer than seven characters after the ACME- prefix, so it did not match the ACME-[A-Z0-9]{7} pattern.

Update the token to match the regex

Edit the repository file so that the acme_token value conforms to the pattern. Only the updated line is shown here:

const acme_token = "ACME-1234567";

Commit the change and run the dry run again.

Dry run result (after updating token)

After updating the token value so it matches the custom regex, the dry run finds the match:

Status: Completed
Repositories: 1
Total duration: 3s
Total matches: 1

Matches:
ACME-1234567  game-devstudio/ghas-guardrail-demo

Publish the pattern

Once you have validated the pattern with dry runs and are confident it matches the intended token format, publish the pattern at the organization level. Published organization-level patterns become active and will raise secret-scanning alerts across the organization’s selected repositories when matches are found during new pushes or scans.

Repository Secret scanning alerts

After publishing the pattern and pushing the updated token to the repository, go to: Repository → Security → Secret scanning alerts You should see alerts for matches found by the published ACME pattern along with any other detected secrets (like AWS keys or PATs). Each alert includes file and commit/branch details and provides actions such as viewing details, marking a false positive, or closing the alert.

A GitHub "Security and quality" screen showing the Secret scanning alerts for a repository, listing three open alerts. Two are labeled "ACME Token" and one is a "GitHub Personal Access Token" flagged as a public leak.

Summary

GitHub Secret Scanning detects many built-in secret formats automatically.
For proprietary or organization-specific tokens, create custom patterns (regex) at the repository or organization level.
Use the dry run feature to validate patterns against existing repositories before publishing.
Published organization-level patterns apply across selected repositories and will generate Secret scanning alerts when matches occur.
Always avoid committing real secrets; use safe mock values for testing.

Course Introduction

Foundation Setup

Identity and Access Management

Governance and Roles

Security and Compliance

GitHub Actions and Runners

Administration and Support

Monitoring and Optimization

Demo GHAS Secret Scanning Custom Patterns

Initial repository state (app.js)

Repository-level vs Organization-level custom patterns

Creating a custom pattern (example)

Dry run: initial result

Update the token to match the regex

Dry run result (after updating token)

Publish the pattern

Repository Secret scanning alerts

Summary

Links and references

Watch Video

​Initial repository state (app.js)

​Repository-level vs Organization-level custom patterns

​Creating a custom pattern (example)

​Dry run: initial result

​Update the token to match the regex

​Dry run result (after updating token)

​Publish the pattern

​Repository Secret scanning alerts

​Summary

​Links and references

Watch Video

Initial repository state (app.js)

Repository-level vs Organization-level custom patterns

Creating a custom pattern (example)

Dry run: initial result

Update the token to match the regex

Dry run result (after updating token)

Publish the pattern

Repository Secret scanning alerts

Summary

Links and references