Question

A startup maintains several open-source projects in public repositories under a free GitHub organization plan. The security lead wants to detect and block leaked credentials in these public repos but has no GitHub Advanced Security or GitHub Secret Protection license. Which statement accurately describes what secret scanning capability the team can use at no additional cost?

Accepted Answer

Secret scanning alerts and push protection are available for free on public repositories, so the team can enable both without a paid license.

Answer

No secret scanning is available at all until the organization purchases a GitHub Secret Protection license for each repository.

Answer

Only push protection is free on public repositories, while secret scanning alerts require a paid GitHub Secret Protection license.

Answer

Secret scanning is free on public repositories, but it only notifies the partner who issued the token and never surfaces alerts to the repository owners.