Question
What happens when you enable secret scanning on a private repository?
- A. Repository administrators can view Dependabot alerts.
- B. Dependency review, secret scanning, and code scanning are enabled.
- C. Your team is subscribed to security alerts.
- D. GitHub performs a read-only analysis on the repository. Correct
Explanation
Once enabled, secret scanning analyzes the repository without changing it: it scans the Git history on all branches, plus content such as issues, pull requests and discussions, and reports any known secret types. People with access to security alerts, such as repository administrators and security managers, then see the detected secrets as secret scanning alerts on the Security tab; these are not Dependabot alerts, which come from a separate feature. Enabling secret scanning does not switch on dependency review or code scanning, which are enabled separately. It also does not subscribe a team to security alerts: a team gets access only when an administrator grants it, and notifications follow each person's own settings.
