– [Configure and Use Secret Scanning] A secret scanning alert should be closed as "used in tests" when a secret is:

The "used in tests" reason for closing a secret scanning alert is specifically for secrets that are not real, sensitive credentials but are instead mock or example tokens created exclusively for testing purposes. The defining characteristic is the secret's purpose and scope; it must have no access to production or other sensitive environments. Its presence in the codebase is considered safe only because the secret itself is non-functional outside of a controlled test context. The location of the secret (e.g., in a test file) is a common characteristic but not the definitive reason for dismissal; the nature of the secret is the critical factor.

A. In the readme.md file.

The file location does not determine the secret's purpose. A real, high-risk production secret could be mistakenly placed in a README file.

B. In a test file.

A real production secret could be accidentally committed within a test file. The location does not negate the risk posed by the credential itself.

D. Not a secret in the production environment.

This is too broad. A secret for a staging or development environment is still a sensitive credential that should be protected, not dismissed as a test case.

1. GitHub Docs, "Managing alerts from secret scanning." In the section "Closing a secret scanning alert," one of the dismissal reasons is "Used in tests." While the UI tooltip may state "The secret is only used in test files," the security principle is that the secret itself is a non-sensitive credential intended for testing. The purpose is to distinguish between real, exploitable secrets and non-exploitable, dummy secrets used in a test suite. This aligns with the secret being "solely used for tests."

Source: GitHub Docs. (2023). Managing alerts from secret scanning. Retrieved from https://docs.github.com/en/code-security/secret-scanning/managing-alerts-from-secret-scanning#closing-a-secret-scanning-alert

2. GitHub Docs, "About secret scanning." The documentation emphasizes that secret scanning works by matching patterns for secrets "used by many service providers." This implies the system is looking for real, structured credentials. The dismissal reasons provide a way to filter out alerts for tokens that match a pattern but are not real, active credentials, such as those used exclusively for testing.

Source: GitHub Docs. (2023). About secret scanning. Retrieved from https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning