– [Configure and Use Secret Scanning] What happens when you enable secret scanning on a private repository?

When secret scanning is enabled for a repository, GitHub initiates a scan of the entire Git history across all branches. This process is a non-intrusive, read-only analysis where the content is checked against a set of patterns for known secret formats. This scan does not alter the repository's code or history. If a potential secret is identified, GitHub creates a security alert, which is visible to repository administrators and the organization owners, and notifies the committer.

A. Dependabot alerts are related to vulnerable dependencies, which is a separate GitHub security feature and not directly enabled or affected by activating secret scanning.

B. Notifications for secret scanning alerts are sent to specific individuals, such as repository administrators and the commit author, not an entire team by default subscription.

D. Enabling secret scanning is a distinct action. It does not automatically enable other GitHub Advanced Security features like code scanning or dependency review, which require separate configuration.

1. GitHub Docs, "About secret scanning." This document states, "When you enable secret scanning for a repository, GitHub scans the code for patterns that match secrets... Secret scanning scans the entire Git history on all branches present in your GitHub repository for secrets." This confirms the read-only analysis of the repository's content.

2. GitHub Docs, "Configuring secret scanning for your repositories." This guide details the steps to enable the feature, clarifying that it is a distinct process from configuring other security tools. It notes, "You can enable secret scanning for any public repository... For private or internal repositories, you must have a license for GitHub Advanced Security." This separation of configuration confirms that enabling one feature does not enable all.

3. GitHub Docs, "Managing alerts from secret scanning." This page describes the notification process: "When a new secret is detected, GitHub notifies the repository administrators... and the author of the commit..." This contradicts the idea of a broad team subscription.