– [Configure and Use Secret Scanning] A secret scanning alert should be closed as "used in tests" when a secret is:

The "used in tests" dismissal reason for a secret scanning alert is appropriate only when the detected string is a mock or example credential created exclusively for testing purposes. The defining characteristic is the secret's intended use and scope—it must have no value or access rights outside of a controlled test environment. The location of the secret (e.g., in a test file) is a contributing factor but not the sole determinant. The crucial point is that the secret itself is not a real, active credential for any environment, including development or staging.

A. A secret in a readme.md file is a severe documentation exposure and should be remediated, not dismissed as a test case.

B. A real, high-value secret can be accidentally committed to a test file; its location does not automatically make it safe or intended for tests.

D. A secret for a non-production environment (e.g., staging, QA) is still a valid credential that poses a security risk and should be remediated.

1. GitHub Docs. "Managing alerts from secret scanning." GitHub Enterprise Cloud Documentation. Accessed October 2023. In the section "Dismissing a secret scanning alert

" the documentation specifies the reasons for closing an alert. The "Used in tests" option is described for cases where "The secret is only used in tests

" confirming that the secret's purpose

not just its location

is the deciding factor.