Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Repo sync #37103

Merged
merged 2 commits into from
Mar 26, 2025
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -40,17 +40,22 @@ If you do not verify your email address, you will not be able to:

## About email verification for {% data variables.enterprise.prodname_managed_users %}

Enterprise Managed Users (EMUs) must now prove ownership of their email addresses to secure their accounts and prevent any accidental data leaks by third party GitHub Apps and OAuth applications.
If you are a member of an {% data variables.enterprise.prodname_emu_enterprise %} and your account was created from August 2024, your email address is unverified by default.
For Enterprise Managed Users (EMUs), email addresses are no longer automatically verified. This prevents unauthorized access and potential data leaks from third-party {% data variables.product.prodname_github_apps %} and OAuth applications that rely on email addresses as a primary identifier.

Having an unverified email address does not affect most actions you can take on {% data variables.product.prodname_dotcom %}. However, we **recommend email verification** for additional account security and to prevent potential exploitation of third-party {% data variables.product.prodname_github_apps %} and {% data variables.product.prodname_oauth_apps %} which may not have followed our best practices around secure authentication methods for apps (see [AUTOTITLE](/apps/oauth-apps/building-oauth-apps/best-practices-for-creating-an-oauth-app) and [AUTOTITLE](/apps/creating-github-apps/about-creating-github-apps/best-practices-for-creating-a-github-app)).
>[!NOTE] If you are a member of an {% data variables.enterprise.prodname_emu_enterprise %} and your account was created after August 1st, 2024, your email address is unverified by default.

Having an unverified email address does not affect most actions you can take on {% data variables.product.prodname_dotcom %}. However, we **recommend email verification** to prevent potential exploitation of third-party {% data variables.product.prodname_github_apps %} and {% data variables.product.prodname_oauth_apps %} which may not have followed our best practices around secure authentication methods for apps (see [AUTOTITLE](/apps/oauth-apps/building-oauth-apps/best-practices-for-creating-an-oauth-app) and [AUTOTITLE](/apps/creating-github-apps/about-creating-github-apps/best-practices-for-creating-a-github-app)).

Until you verify your email address, your account will use a placeholder email address with your enterprise's shortcode appended for certain operations. For example, the [AUTOTITLE](/rest/users/users) and [AUTOTITLE](/rest/users/emails) will return `[email protected]`. In rare cases, you may find that your company's email provider does not handle the placeholder email correctly, or that the placeholder prevents you from accessing some third-party {% data variables.product.prodname_github_apps %} and {% data variables.product.prodname_oauth_apps %}.

You cannot verify an email address for your {% data variables.enterprise.prodname_managed_user %} if the email address is already verified by another account on {% data variables.product.prodname_dotcom_the_website %}. To verify the email, you will need to unverify the email address on the conflicting account, then verify it for your {% data variables.enterprise.prodname_managed_user %}. See [AUTOTITLE](/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/changing-your-primary-email-address).

Once you verify an email with a {% data variables.enterprise.prodname_managed_user %}, you won't be able to use the email to sign up for a personal account on {% data variables.product.prodname_dotcom_the_website %}.

>[!NOTE] If you need to use the same email address for both your {% data variables.enterprise.prodname_managed_user %} and another {% data variables.product.github %} account (for example, for innersource, open source, or other valid use cases), you must sign in to your managed user account and unverify the email in your account settings.
>
> The email will still be linked to your managed user account, so you can continue signing in through your organization's or enterprise's identity provider (IdP). However, because the email is unverified, it may affect your access to third-party applications that identify users based solely on email address.

## Verifying your email address

{% data reusables.user-settings.access_settings %}
Expand Down
88 changes: 88 additions & 0 deletions src/secret-scanning/data/public-docs.yml
Original file line number Diff line number Diff line change
Expand Up @@ -2371,6 +2371,94 @@
hasPushProtection: false
hasValidityCheck: false
isduplicate: false
- provider: Naver Cloud
supportedSecret: Naver Cloud Access Key ID
secretType: navercloud_gov_access_key
versions:
fpt: '*'
ghec: '*'
isPublic: true
isPrivateWithGhas: true
hasPushProtection: false
hasValidityCheck: false
isduplicate: false
- provider: Naver Cloud
supportedSecret: Naver Cloud Secret Key
secretType: navercloud_gov_access_key_secret
versions:
fpt: '*'
ghec: '*'
isPublic: true
isPrivateWithGhas: true
hasPushProtection: false
hasValidityCheck: false
isduplicate: false
- provider: Naver Cloud
supportedSecret: Naver Cloud Secure Token Service
secretType: navercloud_gov_sts
versions:
fpt: '*'
ghec: '*'
isPublic: true
isPrivateWithGhas: true
hasPushProtection: false
hasValidityCheck: false
isduplicate: false
- provider: Naver Cloud
supportedSecret: Naver Cloud Secure Token Service Secret
secretType: navercloud_gov_sts_secret
versions:
fpt: '*'
ghec: '*'
isPublic: true
isPrivateWithGhas: true
hasPushProtection: false
hasValidityCheck: false
isduplicate: false
- provider: Naver Cloud
supportedSecret: Naver Cloud Access Key ID
secretType: navercloud_pub_access_key
versions:
fpt: '*'
ghec: '*'
isPublic: true
isPrivateWithGhas: true
hasPushProtection: false
hasValidityCheck: false
isduplicate: false
- provider: Naver Cloud
supportedSecret: Naver Cloud Secret Key
secretType: navercloud_pub_access_key_secret
versions:
fpt: '*'
ghec: '*'
isPublic: true
isPrivateWithGhas: true
hasPushProtection: false
hasValidityCheck: false
isduplicate: false
- provider: Naver Cloud
supportedSecret: Naver Cloud Secure Token Service
secretType: navercloud_pub_sts
versions:
fpt: '*'
ghec: '*'
isPublic: true
isPrivateWithGhas: true
hasPushProtection: false
hasValidityCheck: false
isduplicate: false
- provider: Naver Cloud
supportedSecret: Naver Cloud Secure Token Service Secret
secretType: navercloud_pub_sts_secret
versions:
fpt: '*'
ghec: '*'
isPublic: true
isPrivateWithGhas: true
hasPushProtection: false
hasValidityCheck: false
isduplicate: false
- provider: Neon
supportedSecret: Neon API Key
secretType: neon_api_key
Expand Down
4 changes: 2 additions & 2 deletions src/secret-scanning/lib/config.json
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
{
"sha": "fb3bf22bb77f01e749ede68e7f11a0f1b6d25664",
"blob-sha": "5a32828593718de8f8974ec02c9d84e723bf3c10",
"sha": "7ea367bac1e494b0b9d0fa5a40588a264b79c5a7",
"blob-sha": "d64c4669737f63e7e742a45d4409b31ac5959b6d",
"targetFilename": "code-security/secret-scanning/introduction/supported-secret-scanning-patterns"
}
Loading