Which statement about Code Scanning findings is accurate?

• A. They are local to the repository
• B. They are global to the organization
• C. They are always published publicly
• D. They only indicate license issues

Answer: (A)

Code Scanning findings are scoped to the repository that was analyzed. Each repository using Code Scanning—via CodeQL or other analyzers—produces its own set of alerts that live in that repo’s Security page. They aren’t global to the organization, so you can have multiple repos with different findings, and visibility is generally limited to that repository unless you explicitly publish or share them. These findings aren’t limited to license issues; they can include a range of issues detected by the analyzers, such as vulnerabilities or quality concerns. So the accurate statement is that Code Scanning findings are local to the repository.