GH-500 · Question #49
What is the minimum role needed in order to view the secret scanning alerts list within the Security tab of a repository?
The correct answer is C. repository owner. Secret scanning alerts contain highly sensitive information - they reveal that a secret (API key, token, credential) has been exposed, which itself is security-sensitive data. GitHub therefore restricts access to the secret scanning alerts list to repository owners by default…
Question
What is the minimum role needed in order to view the secret scanning alerts list within the Security tab of a repository?
Options
- ARead
- BWrite
- Crepository owner
- DAdmin
How the community answered
(27 responses)- A4% (1)
- C93% (25)
- D4% (1)
Explanation
Secret scanning alerts contain highly sensitive information - they reveal that a secret (API key, token, credential) has been exposed, which itself is security-sensitive data. GitHub therefore restricts access to the secret scanning alerts list to repository owners by default. Users with only Read (A) or Write (B) collaborator permissions cannot view these alerts, as exposing the list of found secrets to broad collaborators could be a secondary security risk. Admin collaborators (D) can view the alerts, but the minimum designation is specifically the repository owner role, which is a distinct identity from a collaborator granted Admin permission.
Topics
Community Discussion
No community discussion yet for this question.