Question
A secret scanning alert should be closed as “used in tests” when a secret is:
- A. in a test file.
- B. solely used for tests. Correct
- C. in the readme.md file.
- D. not a secret in the production environment.
Explanation
The "used in tests" close reason means the detected secret is used only for testing, so it gives no access that needs protecting. What counts is how the secret is used, not where it sits: a real credential committed to a test file or to readme.md is still exposed and must be revoked and replaced. Saying a value is not a secret in production does not establish that it is only a test value, because it could still grant access elsewhere.
