GitHub secret scanning is designed to identify credentials and other sensitive values that match supported secret patterns. Among the options listed, private keys are the supported secret type. GitHub classifies private keys such as RSA, OpenSSH, EC, and PGP private keys as generic secret patterns. These are distinct from organization-specific custom patterns, which administrators create by defining their own regular expressions. Usernames and general PII are not treated as standard secret-scanning credential patterns, while “sealed boxes” are not a supported secret category. In current GitHub terminology, generic-pattern detection is separately configurable, so it may need to be enabled for the repository. Nevertheless, of the choices presented, private keys are the valid secret-scanning type.

You should dismiss a code scanning alert if the flagged code is not a true security concern , such as:

Code in test files

Code paths that are unreachable or safe by design

False positives from the scanner

Fixing the code would automatically resolve the alert — not dismiss it. Dismissing is for valid exceptions or noise reduction.

Code scanning is a static analysis feature that examines your source code to identify security vulnerabilities and coding errors . It runs either on every push, pull request, or a scheduled time depending on the workflow configuration.

It does not automatically contact maintainers, scan full Git history, or block pushes unless explicitly configured to do so.

Configuring CodeQL analysis to run on the pull_request event allows vulnerabilities to be identified before proposed changes are merged into a shared or protected branch. GitHub's recommended CodeQL advanced setup commonly analyzes code when a pull request targets the default branch. Any newly introduced security findings can then appear as pull-request annotations or checks, allowing developers to remediate them before merging. A scheduled workflow scans periodically and is useful for discovering newly recognized vulnerabilities in unchanged code, but it does not specifically provide a pre-merge gate. workflow_dispatch requires manual execution, while the issues event is unrelated to source-code changes. Therefore, pull_request provides the appropriate event trigger for detecting newly introduced vulnerabilities before code reaches the shared branch.

Comprehensive and Detailed Explanation:

For code scanning to be triggered on a specific branch, the branch must contain the appropriate workflow file, typically located in the .github/workflows directory. This YAML file defines the code scanning configuration and specifies the events that trigger the scan (e.g., push, pull_request).​

Without the workflow file in the branch, GitHub Actions will not execute the code scanning process for that branch. The repository's visibility (private or public), the status of secret scanning, or the activity level of developers do not directly influence the triggering of code scanning.​

The first step when you receive a secret scanning alert is to revoke the secret if it is still valid. This ensures the secret can no longer be used maliciously. Only after revoking it should you proceed to remove it from the code history and apply other mitigation steps.

Simply deleting the secret from the code does not remove the risk if it hasn’t been revoked — especially since it may already be exposed in commit history.

Requesting a CVE ID for a security advisory in a GitHub repository requires Admin permissions. This level of access is necessary because it involves managing sensitive security information and coordinating with external entities to assign a CVE, which is a formal process that can impact the public perception and security posture of the project.​

The dependency graph in a repository is built by parsing manifest and lock files (like package.json, pom.xml, requirements.txt). It helps GitHub detect dependencies and cross-reference them with known vulnerability databases for alerting.

It is specific to each repository and does not show org-wide or cross-repo summaries.

A Dependabot alert is marked as resolved only after the related pull request is merged into the repository. This indicates that the vulnerable dependency has been officially replaced with a secure version in the active codebase.

Simply generating a PR or passing checks does not change the alert status; merging is the key step.

In a query suite (a .qls file), the **query** key is used to specify the paths to one or more .ql files that should be included in the suite.

Example:

- query: path/to/query.ql

qls is the file format.

qlpack is used for packaging queries, not in suite syntax.