Github doesn't check if the secrets are real or not. Any string that matches one of the regexs gets shared with the appropriate API provider. The provider check

Github doesn't check if the secrets are real or not. Any string that matches one of the regexs gets shared with the appropriate API provider. The provider checks to see if the its a valid credential or not and revokes the key if necessary.