{"meta":{"title":"Defining custom patterns for secret scanning","intro":"Protect your unique secret types by defining custom patterns with regular expressions.","product":"Security and code quality","breadcrumbs":[{"href":"/en/code-security","title":"Security and code quality"},{"href":"/en/code-security/how-tos","title":"How-tos"},{"href":"/en/code-security/how-tos/secure-your-secrets","title":"Secure your secrets"},{"href":"/en/code-security/how-tos/secure-your-secrets/customize-leak-detection","title":"Customize leak detection"},{"href":"/en/code-security/how-tos/secure-your-secrets/customize-leak-detection/define-custom-patterns","title":"Define custom patterns"}],"documentType":"article"},"body":"# Defining custom patterns for secret scanning\n\nProtect your unique secret types by defining custom patterns with regular expressions.\n\n## Defining a custom pattern with Copilot\n\nYou can use AI to generate regular expressions based on a text description of the type of pattern you would like to detect, including optional example strings that should be detected. See [Generating regular expressions for custom patterns with AI](/en/code-security/how-tos/secure-your-secrets/customize-leak-detection/generating-regular-expressions-for-custom-patterns-with-ai).\n\n## Defining a custom pattern for a repository\n\nBefore defining a custom pattern, you must ensure that Secret Protection is enabled on your repository. For more information, see [Enabling secret scanning for your repository](/en/code-security/how-tos/secure-your-secrets/detect-secret-leaks/enable-secret-scanning).\n\n1. On GitHub, navigate to the main page of the repository.\n\n2. Under your repository name, click ** Settings**. If you cannot see the \"Settings\" tab, select the **** dropdown menu, then click **Settings**.\n\n \n\n3. In the \"Security and quality\" section of the sidebar, click ** Advanced Security**.\n\n4. Under \"Secret Protection\", to the right of \"Custom patterns\", click **New pattern**.\n\n5. Enter the details for your new custom pattern. You must at least provide the name for your pattern, and a regular expression for the format of your secret pattern.\n\n 1. In the \"Pattern name\" field, type a name for your pattern.\n 2. In the \"Secret format\" field, type a regular expression for the format of your secret pattern.\n 3. You can click **More options ** to provide other surrounding content or additional match requirements for the secret format. See [Custom patterns reference](/en/code-security/reference/secret-security/custom-patterns#syntax-for-manually-defining-custom-patterns).\n 4. Provide a sample test string to make sure your configuration is matching the patterns you expect.\n\n \n\n6. When you're ready to test your new custom pattern, to identify matches in the repository without creating alerts, click **Save and dry run**.\n\n7. When the dry run finishes, you'll see a sample of results (up to 1000). Review the results and identify any false positive results.\n \n\n8. Edit the new custom pattern to fix any problems with the results, then, to test your changes, click **Save and dry run**.\n\n9. When you're satisfied with your new custom pattern, click **Publish pattern**.\n\n10. Optionally, to enable push protection for your custom pattern, click **Enable**. For more information, see [Push protection](/en/code-security/concepts/secret-security/push-protection).\n\n > \\[!NOTE]\n > The \"Enable\" button isn't available until after the dry run succeeds and you publish the pattern.\n\nAfter your pattern is created, secret scanning scans for any secrets in your entire Git history on all branches present in your GitHub repository. For more information on viewing secret scanning alerts, see [Manage secret scanning alerts](/en/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts).\n\n## Defining a custom pattern for an organization\n\nBefore defining a custom pattern, you must ensure that you enable secret scanning for the repositories that you want to scan in your organization. You can use security configurations to enable secret scanning on all repositories in your organization. For more information, see [Enabling security features at scale](/en/code-security/concepts/security-at-scale/organization-security).\n\n1. In the upper-right corner of GitHub, click your profile picture, then click ** Organizations**.\n\n2. Select an organization by clicking on it.\n\n3. Under your organization name, click ** Settings**. If you cannot see the \"Settings\" tab, select the **** dropdown menu, then click **Settings**.\n\n \n\n4. In the \"Security\" section of the sidebar, select the **Advanced Security** dropdown menu, then click **Global settings**.\n\n5. Under \"Custom patterns\", click **New pattern**.\n\n6. Enter the details for your new custom pattern. You must at least provide the name for your pattern, and a regular expression for the format of your secret pattern.\n\n 1. In the \"Pattern name\" field, type a name for your pattern.\n 2. In the \"Secret format\" field, type a regular expression for the format of your secret pattern.\n 3. You can click **More options ** to provide other surrounding content or additional match requirements for the secret format. See [Custom patterns reference](/en/code-security/reference/secret-security/custom-patterns#syntax-for-manually-defining-custom-patterns).\n 4. Provide a sample test string to make sure your configuration is matching the patterns you expect.\n\n \n\n7. When you're ready to test your new custom pattern, to identify matches in select repositories without creating alerts, click **Save and dry run**.\n\n8. Select the repositories where you want to perform the dry run.\n * To perform the dry run across the entire organization, select **All repositories in the organization**.\n * To specify the repositories where you want to perform the dry run, select **Selected repositories**, then search for and select up to 10 repositories.\n\n9. When you're ready to test your new custom pattern, click **Run**.\n\n10. When the dry run finishes, you'll see a sample of results (up to 1000). Review the results and identify any false positive results.\n \n\n11. Edit the new custom pattern to fix any problems with the results, then, to test your changes, click **Save and dry run**.\n\n12. When you're satisfied with your new custom pattern, click **Publish pattern**.\n\n13. Optionally, to enable push protection for your custom pattern, click **Enable**. For more information, see [Push protection](/en/code-security/concepts/secret-security/push-protection#customization).\n\n > \\[!NOTE]\n >\n > * The option to enable push protection is visible for published patterns only.\n > * Push protection for custom patterns will only apply to repositories in your organization that have secret scanning as push protection enabled.\n > * Enabling push protection for commonly found custom patterns can be disruptive to contributors.\n\nAfter your pattern is created, secret scanning scans for any secrets in repositories in your organization, including their entire Git history on all branches. Organization owners and repository administrators will be alerted to any secrets found and can review the alert in the repository where the secret is found. For more information on viewing secret scanning alerts, see [Manage secret scanning alerts](/en/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts).\n\n## Defining a custom pattern for an enterprise account\n\n> \\[!NOTE]\n>\n> * At the enterprise level, only the creator of a custom pattern can edit the pattern, and use it in a dry run.\n> * You can only perform a dry run on repositories that you have administration access to. If an enterprise owner wants access to perform dry runs on any repository in an organization, they must be assigned the organization owner role. For more information, see [Managing your role in an organization owned by your enterprise](/en/enterprise-cloud@latest/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/managing-your-role-in-an-organization-owned-by-your-enterprise).\n\n1. Navigate to your enterprise. For example, from the [Enterprises](https://github.com/settings/enterprises?ref_product=ghec\\&ref_type=engagement\\&ref_style=text) page on GitHub.com.\n\n2. At the top of the page, click ** Policies**.\n\n3. Under \"Policies\", click **Advanced Security Code security**.\n\n4. Under \"Advanced Security Code security\", click **Security features**.\n\n5. Under \"Secret scanning custom patterns\", click **New pattern**.\n\n6. Enter the details for your new custom pattern. You must at least provide the name for your pattern, and a regular expression for the format of your secret pattern.\n\n 1. In the \"Pattern name\" field, type a name for your pattern.\n 2. In the \"Secret format\" field, type a regular expression for the format of your secret pattern.\n 3. You can click **More options ** to provide other surrounding content or additional match requirements for the secret format. See [Custom patterns reference](/en/code-security/reference/secret-security/custom-patterns#syntax-for-manually-defining-custom-patterns).\n 4. Provide a sample test string to make sure your configuration is matching the patterns you expect.\n\n \n\n7. When you're ready to test your new custom pattern, to identify matches in the enterprise without creating alerts, click **Save and dry run**.\n\n8. Search for and select up to 10 repositories where you want to perform the dry run.\n\n9. When you're ready to test your new custom pattern, click **Run**.\n\n10. When the dry run finishes, you'll see a sample of results (up to 1000). Review the results and identify any false positive results.\n \n\n11. Edit the new custom pattern to fix any problems with the results, then, to test your changes, click **Save and dry run**.\n\n12. When you're satisfied with your new custom pattern, click **Publish pattern**.\n\n13. Optionally, to enable push protection for your custom pattern, click **Enable**. For more information, see [Push protection](/en/code-security/concepts/secret-security/push-protection).\n > \\[!NOTE]\n >\n > * To enable push protection for custom patterns, secret scanning as push protection needs to be enabled at the enterprise level.\n > * Enabling push protection for commonly found custom patterns can be disruptive to contributors.\n\nAfter your pattern is created, secret scanning scans for any secrets in repositories within your organizations with GitHub Secret Protection enabled, including their entire Git history on all branches. Organization owners and repository administrators will be alerted to any secrets found, and can review the alert in the repository where the secret is found. For more information on viewing secret scanning alerts, see [Manage secret scanning alerts](/en/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts)."}