Question

A private repository at your company has GitHub Secret Protection enabled. A developer accidentally commits an AWS access key that belongs to a third-party cloud provider partnered with GitHub. Given that this is a private (non-public) repository, what happens with respect to the detected secret?

Accepted Answer

A secret scanning alert is created and shown to repository administrators and configured recipients within GitHub; the partner is not notified

Answer

GitHub automatically notifies the AWS partner to revoke the key, and no alert is shown in the repository

Answer

No alert is generated because partner-based detection only applies to public repositories

Answer

The commit is silently rejected and the secret is purged from Git history automatically