Question

A security engineer at your company discovers that a valid AWS access key was committed months ago and triggered a secret scanning alert. They immediately revoke the key in AWS, rotate credentials, and mark the alert as 'Revoked' in GitHub. Two weeks later, an automated audit shows the same secret string still exists in the repository's Git history on the default branch. What is the correct understanding of the alert's state and the appropriate next action?

Accepted Answer

Resolving an alert (e.g., as 'Revoked') closes it in GitHub but does not remove the exposed secret from Git history; the remediation is complete because the credential is invalidated, though history rewriting may still be desired.

Answer

Marking the alert as 'Revoked' automatically purges the secret from Git history, so no further action is needed; the audit finding is a false positive.

Answer

The alert should be reopened because a resolved alert requires the secret string to be deleted from history before it can be closed, otherwise GitHub reverts the status automatically.

Answer

Because the secret still exists in history, the alert must be dismissed as 'Used in tests' to suppress future detections of the same pattern.