When secret scanning detects a set of credentials on a public repository, what does GitHub do?

Question

Options

• AIt sends a notification to repository members.
• BIt displays a public alert in the Security tab of the repository.
• CIt notifies the service provider who issued the secret.
• DIt scans the contents of the commits for additional secrets.

• A
  5% (2)
• B
  90% (37)
• C
  2% (1)
• D
  2% (1)

Explanation

When secret scanning detects credentials in a public repository, GitHub displays a public alert in the repository's Security tab. Because the repository is public, this alert is visible to anyone who can view the repository. GitHub does not send notifications to repository members (A) - those are for private repositories with GitHub Advanced Security. Notifying the service provider (C) is what happens for partner patterns under a separate partner notification program, but the direct GitHub action for public repos is displaying the Security tab alert. GitHub does not scan additional commit history (D) as a response action.

No community discussion yet for this question.