Question

A developer at your company accidentally commits an AWS access key to a public repository owned by your organization. Your team has NOT explicitly enabled any secret scanning features on this public repo. Which statement best describes what happens automatically with respect to this exposed credential?

Accepted Answer

GitHub's secret scanning partner program automatically scans the public repo and notifies the relevant service provider (AWS) so they can revoke or take action on the leaked key.

Answer

Nothing happens automatically, incorrectly assuming secret scanning requires GitHub Secret Protection to be explicitly enabled on the repository first.

Answer

Push protection automatically blocked the commit at push time, so the key was never actually exposed in the repository.

Answer

A high-confidence secret scanning alert is created in the repository's Security tab and the organization owners receive an email, regardless of any configuration.