Question

A security team runs a remediation campaign and wants accurate metrics on how many code scanning alerts were genuinely resolved through code changes versus those that were triaged away without a fix. During the campaign, engineers merge PRs that remove the vulnerable code paths, and reviewers also dismiss several alerts they judge to be false positives. When the security lead reviews the code scanning results after the next default-branch scan, how will these two categories of alerts be distinguished in the alert list?

Accepted Answer

Alerts whose underlying code was remediated automatically transition to a 'Fixed' state after a scan no longer detects them, while manually triaged alerts appear in a 'Closed' state with a 'Dismissed' reason.

Answer

Both remediated and dismissed alerts appear identically as 'Closed', so the team must rely on PR links to tell them apart.

Answer

Remediated alerts must be manually marked as 'Fixed' by a reviewer, since GitHub cannot detect that vulnerable code was removed.

Answer

Dismissed alerts are permanently deleted from the alert list, so only 'Fixed' alerts remain visible for reporting.