– [Configure and Use Secret Scanning] What is the first step you should take to fix an alert in secret scanning?

When a secret scanning alert is triggered for a valid secret, the secret must be considered compromised. The immediate and most critical first step is to revoke or rotate the credential to prevent its malicious use. This action invalidates the exposed secret, mitigating the immediate security risk. After the secret has been revoked, you should then proceed to remove it from the repository's commit history and update your code with a new, securely stored secret.

A. Archiving a repository makes it read-only but does not remove the compromised secret from the commit history, leaving it exposed.

B. Updating dependencies is the correct action for Dependabot alerts regarding vulnerable packages, not for secret scanning alerts about exposed credentials.

D. Removing the secret in a new commit is insufficient because the secret remains accessible in the repository's previous commit history.

1. GitHub Docs

"Managing alerts from secret scanning." This official documentation outlines the remediation process. It states

"Once a secret is committed to a repository

you should consider the secret compromised... For all other secrets

first verify that the secret committed to GitHub is valid. If it is

create a new secret

update any services that use the old secret

and then delete the old secret." This process is functionally equivalent to revoking the secret. (Source: GitHub Docs > Code security > Secret scanning > Managing alerts from secret scanning).