Configure custom secret patterns for organization-specific tokens
Implementation Effort: Medium – Defining and testing custom secret patterns, publishing them at scope, and standing up compensating controls for Azure DevOps takes iterative work across security and repository administrators. User Impact: Low – Custom patterns are configured by administrators and run inside secret scanning; end users are not prompted or affected. Lifecycle Stage: Code
Overview
Configure custom secret patterns to detect organization-specific tokens and credentials that built-in scanning rules do not recognize. GitHub secret scanning and GitHub Advanced Security for Azure DevOps detect a wide range of known credential patterns from cloud providers, SaaS platforms, and package registries.
Every organization also creates its own credential formats—internal API keys with custom prefixes, proprietary authentication tokens, database connection strings with organization-specific naming conventions, and service-to-service credentials that follow internal standards. Built-in scanning patterns do not recognize these formats, which means organization-specific secrets can be committed to repositories, persist in history, and circulate through forks and clones without generating any alert.
On GitHub, custom secret scanning patterns let administrators define regular expressions for internal token formats, test them with dry runs, publish them at repository or organization scope, and optionally enable push protection for those patterns.
GitHub Advanced Security for Azure DevOps currently does not support custom secret scanning patterns. Organizations using Azure Repos must use compensating controls: implement pre-commit hooks with tools like detect-secrets or TruffleHog, integrate secret scanning in pipeline validation stages, enforce strict secret rotation policies, and maintain rapid response SLAs for secret scanning alerts.
Custom patterns where supported close this blind spot by extending detection to the credential formats unique to the organization. Without them, organizations can develop a false sense of coverage and miss the internal tokens that often unlock backend systems, databases, and APIs. By extending secret detection to the organization's own credential formats so exposures are caught wherever they occur, this task supports Assume breach.