Enabling delegated alert dismissal for secret scanning

You can use delegated alert dismissal to control who can dismiss an alert found by secret scanning.

Note

The implementation of this approval process can potentially cause some friction, so it's important to ensure that the team of security managers has adequate coverage to review dismissal requests regularly before proceeding.

Alert dismissal requests expire after 1 week. After this, dismissal requests must be resubmitted.

Configuring delegated dismissal for a repository

If an organization owner configures delegated alert dismissal via an enforced security configuration, the settings can't be changed at the repository level.

  1. On GitHub, navigate to the main page of the repository.

  2. Under your repository name, click Settings. If you cannot see the "Settings" tab, select the dropdown menu, then click Settings.

    Screenshot of a repository header showing the tabs. The "Settings" tab is highlighted by a dark orange outline.

  3. In the "Security and quality" section of the sidebar, click Advanced Security.

  4. Under "Secret Protection", to the right of "Prevent direct alert dismissals", click Enable.

Configuring delegated dismissal for an organization

You must configure delegated dismissal for your organization using a custom security configuration. You can then apply the security configuration to all (or selected) repositories in your organization.

  1. Create a new custom security configuration, or edit an existing one. See Creating a custom security configuration.
  2. When defining the custom security configuration, under "Secret scanning", ensure that the dropdown menu for "Prevent direct alert dismissals" is set to Enabled.
  3. Click Save configuration.
  4. Apply the security configuration to all (or selected) repositories in your organization. See Applying a custom security configuration.

To learn more about security configurations, see Enabling security features at scale.

Note

You can use GitHub Apps with fine-grained permissions to programmatically review and approve delegated dismissal requests. This enables your organization to streamline security request reviews and enforce policies, or integrate with external security tools, ensuring that all reviews meet established standards. For GitHub Enterprise Server, the use of GitHub Apps to review requests for delegated dismissals is available from version 3.19.
For more information about permissions, see Organization permissions for "Organization bypass requests for secret scanning".

Configuring delegated dismissal for an enterprise

  1. Create a new custom security configuration, or edit an existing one. See Creating a custom security configuration for your enterprise.
  2. When defining the custom security configuration, under "Secret Protection", ensure that the dropdown menu for "Prevent direct alert dismissals" is set to Enabled.
  3. Click Save configuration.
  4. Apply the security configuration to all (or selected) repositories in your enterprise. See Applying a custom security configuration to your enterprise.

Next steps

Now that you have enabled delegated alert dismissal for secret scanning, you should regularly review alert dismissal requests to maintain an accurate alert count and unblock your developers. See Reviewing alert dismissal requests.