Which of the following would raise secret scanning alerts?

The correct answer is A. GitHub personal access token. Secret scanning is designed to detect credentials, tokens, API keys, and other sensitive strings that should never be committed to a repository. A GitHub personal access token (PAT) is exactly this type of secret and will trigger an alert. XSS, SQL injection, and server-side…

Configure and use secret scanning

Question

Options

AGitHub personal access token
Bserver-side request forgery
Ccross site scripting (XSS)
Dstructured query language (SQL) injection

How the community answered

(66 responses)

A
92% (61)
B
2% (1)
C
2% (1)
D
5% (3)

Explanation

Secret scanning is designed to detect credentials, tokens, API keys, and other sensitive strings that should never be committed to a repository. A GitHub personal access token (PAT) is exactly this type of secret and will trigger an alert. XSS, SQL injection, and server-side request forgery (SSRF) are code vulnerabilities - not secrets - and are detected by code scanning tools like CodeQL, not secret scanning.

Topics

#Secret scanning#GitHub tokens#Credentials#Alerts

Community Discussion

No community discussion yet for this question.

Full GH-500 Practice