How does GitHub handle secrets found via secret scanning in a public repository?

Question

Options

• AIt alerts the service provider (e.g., AWS, Stripe).
• BIt immediately blocks the commit to protect the secret.
• CIt deletes the secret from the repository automatically.
• DIt notifies the admin via webhook.

• A
  89% (39)
• B
  5% (2)
• C
  5% (2)
• D
  2% (1)

Explanation

GitHub's secret scanning feature works by detecting exposed credentials and automatically notifying the affected service provider (like AWS, Stripe, or GitHub itself), which can then revoke or flag the compromised token before it's exploited - this is the core of its partner notification program.

Why the distractors are wrong:

• B is incorrect because secret scanning is a detection tool, not a pre-receive hook - it doesn't block commits. Push protection (a separate feature) can block pushes, but that's not what secret scanning does post-exposure.
• C is incorrect because GitHub never modifies or deletes your repository content automatically - that would be a destructive action without user consent.
• D is incorrect because the notification goes to the service provider (the token issuer), not the repository admin via webhook. The repo owner may get an alert, but the defining action is the partner notification.

Memory tip: Think of GitHub as a "whistleblower" - when it finds a leaked API key, it tells the company that issued the key (AWS, Stripe, etc.) so they can lock it down. The key holder, not the repo owner, is the first responder.

No community discussion yet for this question.