npm packages are no longer signed with PGP signatures

GitHub Advanced Security customers can now enable validity checks for supported partner patterns in their repository, organization, or enterprise level code security settings.

When you enable the checkbox in your settings, GitHub will automatically check validation for patterns on a cadence by sending the pattern to our relevant partner provider. You can use the validation status on leaked secrets to help prioritize secrets needing remediation action.

As we continuously work with our partners to add support for more patterns, we'll update the "Validity check" column in our documented supported patterns list.

• Learn more about secret scanning
• Become a secret scanning partner
• Got feedback? Open a discussion in our code security discussion.

GitHub secret scanning protects users by searching repositories for known types of secrets. By identifying and flagging these secrets, our scans help prevent data leaks and fraud.

We have partnered with Grafana Labs to scan for their tokens and help secure our mutual users on public repositories. Grafana tokens allow users to manage all resources within Grafana installations, and Grafana Cloud tokens can be used to authorize data ingestion requests and to manage the lifecycle of stacks. GitHub will forward access tokens found in public repositories to Grafana Labs, and they will automatically revoke the token and notify affected customers. You can read more information about Grafana's various tokens below:

• Grafana Service Account tokens
• Grafana API keys
• Grafana Cloud API keys
• Grafana Cloud Access Policies tokens

GitHub Advanced Security customers can also scan for Grafana tokens and block them from entering their private and public repositories with push protection.

• Learn more about secret scanning
• Partner with GitHub on secret scanning