Question

A security analyst is triaging Secret Scanning alerts in a private repository with GitHub Secret Protection enabled. One alert flags a token that a developer confirms is a fake, non-functional value hardcoded intentionally as a fixture in the automated test suite. The analyst wants to close the alert while preserving accurate context for future audits and reporting. Which action should the analyst take?

Accepted Answer

Dismiss the alert with the reason "Used in tests" so it is closed as a resolved false-positive-style dismissal with documented context

Answer

Mark the alert as "Revoked" after confirming the token has no real access, since it cannot be exploited

Answer

Delete the alert entirely from the repository's security tab so it no longer appears in reports

Answer

Leave the alert open and instead add the test file path to a code scanning exclusion list