What method does GitHub's secret scanning primarily use to detect secrets?

• A. Pattern-based detectors that recognize common secret formats
• B. Machine learning-based anomaly detection
• C. User-reported secret scans only
• D. Manual code review

Answer: (A)

The method being tested is pattern-based detectors that recognize common secret formats. Secrets often have recognizable structures—specific prefixes, lengths, and character sets—that can be codified into detectors using patterns and regular expressions. By maintaining a library of these formats (for API keys, tokens, credentials, etc.), the system can quickly flag anything that matches a known secret pattern across code, configuration files, and other content. This approach is efficient, scalable, and effective for catching the wide variety of secrets that appear in real repositories, which is why it’s the primary method used.

While machine learning or anomaly detection can serve as supplementary techniques in some tools, they’re not the main mechanism for GitHub’s secret scanning. They can help surface unusual patterns, but they often come with trade-offs like higher false positives or the need for extensive labeled data. User reports and manual reviews exist to assist with remediation and verification, but the detection itself relies on pattern-based recognition of established secret formats.