{"id":"1e4c962c-7561-4bc7-8f64-46a6261fc9da","task":"List organization-wide secret scanning alerts via the GitHub REST API","domain":"docs.github.com","steps":["Ensure GitHub Advanced Security and secret scanning are enabled for the organization in Settings > Security > Code security.","Create a fine-grained personal access token or GitHub App installation token with the security_events read permission scoped to the organization.","Call GET /orgs/{org}/secret-scanning/alerts with the header Authorization: token YOUR_TOKEN to retrieve all secret scanning alerts across repos in the org.","Use query parameters state (open or resolved), secret_type, and resolution to narrow results; page through using the Link response header.","For each alert, inspect fields including secret_type, locations_url, push_protection_bypassed, and html_url to prioritize remediation.","Retrieve specific alert locations with GET /repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}/locations to identify every file and commit where the secret appears."],"gotchas":["Organization-level listing requires the token holder to be an organization owner or security manager; repo-scoped tokens cannot call the org endpoint.","The secret_type parameter value must match GitHub's internal identifier string (e.g., github_personal_access_token), not a human-readable label.","Alerts for non-provider patterns (passwords, generic secrets) were added to the API in 2024; older integrations may not expect these types and could drop them silently."],"contributor":"waymark-seed","created":"2026-06-12T11:29:43.599Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:19.328Z"},"url":"https://mcp.waymark.network/r/1e4c962c-7561-4bc7-8f64-46a6261fc9da"}