github · docs-bot · Sep 16, 2026 · Sep 15, 2026 · Sep 16, 2026 · Sep 16, 2026
diff --git a/content/code-security/concepts/secret-security/secret-scanning.md b/content/code-security/concepts/secret-security/secret-scanning.md
@@ -59,7 +59,9 @@ Beyond the default detection of partner and provider secrets, you can expand and
 
 * **Generic patterns.** Expand detection to secrets that aren't tied to a specific service provider, such as private keys, connection strings, and generic API keys.
 * **Custom patterns.** Define your own regular expressions to detect organization-specific secrets that aren't covered by default patterns.
+{% ifversion secret-scanning-validity-check-partner-patterns %}
 * **Validity checks.** Prioritize remediation by checking whether detected secrets are still active.
+{% endif %}
 {% ifversion secret-scanning-ai-generic-secret-detection %}
 * **{% data variables.secret-scanning.ai-detected-secrets-caps %}.** Use AI to detect unstructured secrets like passwords.
 {% endif %}

diff --git a/content/code-security/concepts/secret-security/validity-checks.md b/content/code-security/concepts/secret-security/validity-checks.md
@@ -1,7 +1,7 @@
 ---
 title: Validity checks
 shortTitle: Validity checks
-intro: Validity checks and extended metadata checks help you prioritize remediation of exposed credentials that pose immediate security risks.
+intro: Validity checks{% ifversion secret-scanning-extended-metadata-checks %} and extended metadata checks{% endif %} help you prioritize remediation of exposed credentials that pose immediate security risks.
 product: |
   {% data reusables.gated-features.secret-scanning %}{% ifversion secret-risk-assessment %}
 
@@ -33,6 +33,8 @@ Some secrets require more than the token itself to confirm whether they are acti
 
 {% data variables.product.github %} displays the validation status of the secret in the alert view, so you can see if the secret is `active`, `inactive`, or if the validation status is `unknown`. For most secrets, you can optionally perform an "on-demand" validity check for the secret in the alert view.
 
+{% ifversion secret-scanning-extended-metadata-checks %}
+
 ## About extended metadata checks
 
 {% data reusables.security-configurations.extended-metadata-checks %}
@@ -49,14 +51,16 @@ You can enable extended metadata checks if validity checks are enabled. Then, yo
 
 The specific metadata available depends on what the service provider shares with {% data variables.product.github %}. Not all secret types support extended metadata checks. For more information, see [AUTOTITLE](/code-security/tutorials/remediate-leaked-secrets/evaluating-alerts).
 
-## Getting started with validity and extended metadata checks
+{% endif %}
+
+## Getting started with validity{% ifversion secret-scanning-extended-metadata-checks %} and extended metadata{% endif %} checks
 
-You can enable validity and extended metadata checks at the repository, organization, or enterprise level to help prioritize which exposed credentials pose the most immediate security risks.
+You can enable validity{% ifversion secret-scanning-extended-metadata-checks %} and extended metadata{% endif %} checks at the repository, organization, or enterprise level to help prioritize which exposed credentials pose the most immediate security risks.
 
 For large organizations, we recommend using **security configurations** to enable these features at the organization or enterprise level. Security configurations allow you to centrally manage  {% data variables.product.prodname_secret_scanning %} settings and apply them consistently across many repositories.
 
 To get started:
 
-* For repositories, see [AUTOTITLE](/code-security/how-tos/secure-your-secrets/customize-leak-detection/enable-validity-checks)
+* For repositories, see [AUTOTITLE](/code-security/how-tos/secure-your-secrets/customize-leak-detection/enable-validity-checks){% ifversion secret-scanning-extended-metadata-checks %} and [AUTOTITLE](/code-security/how-tos/secure-your-secrets/customize-leak-detection/enable-metadata-checks){% endif %}
 * For an organization, see [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-organization-security/establish-complete-coverage/create-custom-configuration)
 * For an enterprise, see [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-enterprise-security/establish-complete-coverage/create-custom-configuration)
diff --git a/...-enterprise-security/establish-complete-coverage/create-custom-configuration.md b/...-enterprise-security/establish-complete-coverage/create-custom-configuration.md
@@ -43,7 +43,7 @@ When creating a security configuration, keep in mind that:
 1. To help identify your {% data variables.product.prodname_custom_security_configuration %} and clarify its purpose on the "{% data variables.product.prodname_security_configurations_caps %}" page, name your configuration and create a description.
 1. Optionally, enable "{% data variables.product.prodname_secret_protection %}", a paid feature for private {% ifversion ghec %}and internal {% endif %} repositories. Enabling {% data variables.product.prodname_secret_protection %} enables alerts for {% data variables.product.prodname_secret_scanning %}. In addition, you can choose whether to enable, disable, or keep the existing settings for the following {% data variables.product.prodname_secret_scanning %} features:{% ifversion secret-scanning-validity-check-partner-patterns %}
     * **Validity checks**. To learn more about validity checks for partner patterns, see [AUTOTITLE](/code-security/tutorials/remediate-leaked-secrets/evaluating-alerts#checking-a-secrets-validity).{% ifversion ghes > 3.19 %}
-       Your site administrator must enable validity checks before you can use this feature. See [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/configure-secret-scanning).{% endif %}{% endif %}{% ifversion fpt or ghec %}
+       Your site administrator must enable validity checks before you can use this feature. See [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/configure-secret-scanning).{% endif %}{% endif %}{% ifversion secret-scanning-extended-metadata-checks %}
     * **Extended metadata**. To learn more about extended metadata checks, see [About extended metadata checks](/code-security/concepts/secret-security/validity-checks#about-extended-metadata-checks) and [AUTOTITLE](/code-security/tutorials/remediate-leaked-secrets/evaluating-alerts#reviewing-extended-metadata-for-a-token).
     > [!NOTE]
     > You can only enable extended metadata checks if validity checks are enabled.{% endif %}

diff --git a/...rganization-security/establish-complete-coverage/create-custom-configuration.md b/...rganization-security/establish-complete-coverage/create-custom-configuration.md
@@ -51,7 +51,7 @@ When creating a security configuration, keep in mind that:
 1. To help identify your {% data variables.product.prodname_custom_security_configuration %} and clarify its purpose on the "{% data variables.product.prodname_security_configurations_caps %}" page, name your configuration and create a description.
 1. Optionally, enable "{% data variables.product.prodname_secret_protection %}", a paid feature for private {% ifversion ghec %}and internal {% endif %} repositories. Enabling {% data variables.product.prodname_secret_protection %} enables alerts for {% data variables.product.prodname_secret_scanning %}. In addition, you can choose whether to enable, disable, or keep the existing settings for the following {% data variables.product.prodname_secret_scanning %} features:{% ifversion secret-scanning-validity-check-partner-patterns %}
     * **Validity checks**. To learn more about validity checks for partner patterns, see [AUTOTITLE](/code-security/tutorials/remediate-leaked-secrets/evaluating-alerts#checking-a-secrets-validity).{% ifversion ghes > 3.19 %}
-       Your site administrator must enable validity checks before you can use this feature. See [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/configure-secret-scanning).{% endif %}{% endif %}{% ifversion fpt or ghec %}
+       Your site administrator must enable validity checks before you can use this feature. See [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/configure-secret-scanning).{% endif %}{% endif %}{% ifversion secret-scanning-extended-metadata-checks %}
     * **Extended metadata**. To learn more about extended metadata checks, see [About extended metadata checks](/code-security/concepts/secret-security/validity-checks#about-extended-metadata-checks) and [AUTOTITLE](/code-security/tutorials/remediate-leaked-secrets/evaluating-alerts#reviewing-extended-metadata-for-a-token).
     > [!NOTE]
     > You can only enable extended metadata checks if validity checks are enabled.{% endif %}

diff --git a/...t/code-security/reference/secret-security/supported-secret-scanning-patterns.md b/...t/code-security/reference/secret-security/supported-secret-scanning-patterns.md
@@ -42,11 +42,15 @@ If you use the REST API for {% data variables.product.prodname_secret_scanning %
 | Push protection (default) | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} (most) |
 | Push protection (configurable) | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | Some |
 | Validity checks | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | Some |
-| Extended metadata | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | Some |
+| Extended metadata | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | {% ifversion secret-scanning-extended-metadata-checks %}Some{% else %}{% data variables.product.company_short %} tokens only{% endif %} |
 | Base64 format support | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} | Some |
 
+{% ifversion secret-scanning-validity-check-partner-patterns %}
+
 > [!NOTE]
-> Validity and extended metadata checks are only available to users with {% data variables.product.prodname_team %} or {% data variables.product.prodname_enterprise %} who enable the feature as part of {% data variables.product.prodname_GH_secret_protection %}.
+> Validity{% ifversion secret-scanning-extended-metadata-checks %} and extended metadata{% endif %} checks for partner patterns are only available to users with {% data variables.product.prodname_team %} or {% data variables.product.prodname_enterprise %} who enable the feature as part of {% data variables.product.prodname_GH_secret_protection %}.
+
+{% endif %}
 
 ## Supported generic patterns
 

diff --git a/content/code-security/tutorials/remediate-leaked-secrets/evaluating-alerts.md b/content/code-security/tutorials/remediate-leaked-secrets/evaluating-alerts.md
@@ -57,12 +57,16 @@ With a {% data variables.copilot.copilot_enterprise %} license, you can ask {% d
 
 You can use the REST API to retrieve a list of the most recent validation status for each of your tokens. For more information, see [AUTOTITLE](/rest/secret-scanning) in the REST API documentation. You can also use webhooks to be notified of activity relating to a {% data variables.product.prodname_secret_scanning %} alert. For more information, see the `secret_scanning_alert` event in [AUTOTITLE](/webhooks/webhook-events-and-payloads?actionType=created#secret_scanning_alert).
 
+{% ifversion secret-scanning-validity-check-partner-patterns %}
+
 ## Performing an on-demand validity check
 
 Once you have enabled validity checks for partner patterns for your repository, you can perform an "on-demand" validity check for any supported secret by clicking **{% octicon "sync" aria-hidden="true" aria-label="sync" %} Verify secret** in the alert view. {% data variables.product.company_short %} will send the pattern to the relevant partner and display the validation status of the secret in the alert view.
 
 ![Screenshot of the UI showing a {% data variables.product.prodname_secret_scanning %} alert. A button, labeled "Verify secret" is highlighted with an orange outline.](/assets/images/help/security/secret-scanning-verify-secret.png)
 
+{% endif %}
+
 ## Reviewing {% data variables.product.company_short %} token metadata
 
 > [!NOTE]

diff --git a/content/code-security/tutorials/secret-scanning-partner-program.md b/content/code-security/tutorials/secret-scanning-partner-program.md
@@ -90,25 +90,28 @@ The message body is a JSON array that contains one or more objects, with each ob
 
 The list of valid values for `source` are:
 
-* Content
-* Commit
-* Pull_request_title
-* Pull_request_description
-* Pull_request_comment
-* Issue_title
-* Issue_description
-* Issue_comment
-* Discussion_title
-* Discussion_body
-* Discussion_comment
-* Commit_comment
-* Gist_content
-* Gist_comment
-* Wiki_content
-* Wiki_commit
-* Npm
-* Manual_submission
-* Unknown
+* `content`
+* `commit`
+* `pull_request_title`
+* `pull_request_description`
+* `pull_request_comment`
+* `issue_title`
+* `issue_description`
+* `issue_comment`
+* `discussion_title`
+* `discussion_body`
+* `discussion_comment`
+* `commit_comment`
+* `gist_content`
+* `gist_comment`
+* `wiki_content`
+* `wiki_commit`
+* `npm`
+* `manual_submission`
+* `action_logs`
+* `unknown`
+
+A `source` of `action_logs` means the match was found in the logs of a {% data variables.product.prodname_actions %} workflow run in a public repository.
 
 ### Implement signature verification in your secret alert service