Security: enable secret scanning non-provider patterns + validity checks (UI/settings) #34

Parent: #29

Outcome (2026-09-26)

Not available on this repository. Owner type is User (not Organization). GitHub documents Generic patterns (non-provider patterns) and Validity checks for partner patterns primarily for organization-owned repos with GitHub Secret Protection (Team+). On this User-owned public repo, the Settings UI does not offer usable Enable controls for those two extras, and API PATCH returns HTTP 200 but leaves both toggles disabled (silent no-op).

Already enabled (keep)

• secret_scanning: enabled
• secret_scanning_push_protection: enabled
• dependabot_security_updates: enabled

Still disabled (expected / N/A here)

• secret_scanning_non_provider_patterns
• secret_scanning_validity_checks

If this repo later moves to an Organization + Secret Protection

Settings path (eligible org repos only):

1. Repository → Settings
2. Security and quality → Advanced Security
3. Under Secret Protection: enable Generic patterns and/or Validity checks (then Save changes if prompted)

Direct settings URL shape: https://github.com/<org>/<repo>/settings/security_analysis

Docs:

• https://docs.github.com/en/code-security/how-tos/secure-your-secrets/detect-secret-leaks/enabling-secret-scanning-for-generic-patterns
• https://docs.github.com/en/code-security/how-tos/secure-your-secrets/customize-leak-detection/enable-validity-checks
• Partner validity checks eligibility: https://docs.github.com/en/code-security/tutorials/remediate-leaked-secrets/evaluating-alerts

Recommendation

Close this issue as N/A / account limitation. Optional later epic only if the repo is transferred to an Organization and Secret Protection is purchased.