A secret scanning alert should be closed as "used in tests" when a secret is:

The correct answer is B. solely used for tests. The 'used in tests' dismissal reason in GitHub secret scanning requires that the secret is solely used for testing purposes - not just that it appears in a test file. A credential in a test file could still be a real, valid secret used against a production service. The…

Implement and manage secret scanning

Question

A secret scanning alert should be closed as “used in tests” when a secret is:

Options

Ain a test file.
Bsolely used for tests.
Cin the readme.md file.
Dnot a secret in the production environment.

How the community answered

(47 responses)

B
94% (44)
C
2% (1)
D
4% (2)

Explanation

The 'used in tests' dismissal reason in GitHub secret scanning requires that the secret is solely used for testing purposes - not just that it appears in a test file. A credential in a test file could still be a real, valid secret used against a production service. The distinction is functional: if the secret has no role outside of test environments and holds no real risk, it qualifies. Simply being located in a test file (A) is insufficient, as the file location alone doesn't determine whether the secret is real or dangerous.

Topics

#Secret scanning#Alert resolution#GHAS#Test secrets

Community Discussion

No community discussion yet for this question.

Full GH-500 Practice