How are rule severities configured for Code Scanning alerts?

• A. Map or adjust severities in the Code Scanning configuration or UI to influence triage emphasis on results.
• B. Severities are fixed and cannot be changed.
• C. Only the most severe alerts can be viewed.
• D. Severities are configured outside of GitHub.

Answer: (A)

Rule severities in Code Scanning are adjustable so you control how alerts are prioritized during triage. You map or set the severity for each rule either in the Code Scanning configuration file or directly in the UI. That mapping determines how important an alert is considered and therefore how attention is focused during review, allowing teams to highlight high-risk issues and deprioritize lower-risk ones. This flexibility means severities are not fixed; you can tailor them to reflect your project’s risk tolerance and review workflow. Severities aren’t configured outside of GitHub, and you can still view and triage a range of alerts, not just the most severe.