Question

At Contoso, a security lead wants to ensure that a specific compliance analyst receives secret scanning alert notifications for a private repository. The analyst currently has Read access to the repository. When the lead tries to add the analyst as an alert recipient (or expects them to see alerts), it does not work. What is the underlying reason and correct action?

Accepted Answer

Secret scanning alerts are only visible to users with admin, security manager, or an org-defined role granting access to alerts; the analyst needs elevated access rather than just Read.

Answer

Alert notifications can only be sent to the repository owner, so the lead must transfer ownership to the analyst.

Answer

Read access is sufficient, so the issue must be that email notifications are globally disabled at the enterprise level.

Answer

The analyst must first commit code to the repository to be automatically registered as an alert recipient.