Question

At Meridian Software, a code scanning alert for a potential SQL injection is raised on a pull request. The team is clarifying responsibilities: the developer who opened the PR, the security team that owns organization policy, and the repository admin. According to GitHub's recommended division of responsibilities for handling code scanning alerts, who is primarily responsible for remediating the flagged vulnerability in the code before the PR is merged?

Accepted Answer

The developer who authored the pull request, by fixing the flagged code or justifying/dismissing the alert

Answer

The security team, who must directly edit the branch to patch the vulnerability

Answer

The repository admin, who should merge the PR and open a follow-up issue for later

Answer

GitHub Advanced Security, which automatically applies the suggested fix on merge