What is the process for triaging a Code Scanning alert?

• A. Open the alert, review location and rule, determine severity, reproduce if needed, assign to a developer, and decide on remediation or dismissal.
• B. Wait for automatic escalation by system.
• C. Delete the alert and ignore.
• D. Submit a pull request to remove the rule.

Answer: (A)

Triaging a Code Scanning alert is about quickly validating and prioritizing findings by looking at exactly where in the code the issue was detected and which rule fired. That context helps you understand what kind of weakness or vulnerability is being flagged and how risky it might be. Next, you determine the severity to gauge urgency and follow-up effort. If the finding isn’t immediately clear, you reproduce the alert or verify it to avoid chasing a false positive. Then you assign the alert to the developer or team responsible for that code area so the right person handles it. Finally, you decide on remediation or dismissal: fix the code if needed, apply an appropriate suppression or exception with clear notes if it’s not a real issue, or mark it as dismissed if it’s a known false positive. This sequence keeps alerts actionable and prevents them from being ignored or mishandled.