← All permissions
Repository permission·secret_scanning_alerts:read
Secret scanning alerts: Read
Tier 1 · High
Why Tier 1
Reads secret scanning alerts, which include the leaked secret values themselves. Reading this is reading credentials.
Data plane permissions start at Tier 2. This one is raised for the reason above.
- Target
- Repository
- Plane
- DataCode security: Code scanning, Dependabot and secret scanning alerts, advisories, dismissals and bypasses.
- Granted by
- Fine-grained PAT, GitHub App
- Available on
- Every setup
What it unlocks
18 REST endpoints need this permission. A few of them:
- GET /orgs/{org}/secret-scanning/alerts
- DELETE /repos/{owner}/{repo}/bypass-responses/secret-scanning/{bypass_response_id}
- GET /repos/{owner}/{repo}/secret-scanning/alerts
- GET /repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}
Roles that include it
- T0OwnerThe organization and every repository in it
- T0All-repository adminEvery repository in the organization
- T1AdminOne repository
- T1Security managerThe organization and every repository in it
- T1Enterprise security managerEvery organization in the enterprise
Classic scopes that reach it
- T0repodocumented
- T1security_eventsdocumented
Attack paths
Escalations it starts
- Harvest leaked secrets from scanning alerts: Live credentials found in code and history: cloud keys, tokens and passwords, often for systems outside GitHub.
Other levels
GitHub Docs: Repository permissions for "Secret scanning alerts"