An organisation wants to define how alert handling is divided between developers and the security team. Developers should remediate findings in their own repositories, but the organisation wants to make sure that closing certain critical alerts is not left solely to individual developers. Which approach reflects how GitHub supports this division of responsibility for security alerts?
- AClosing any security alert always requires organisation owner permission, so developers with write access can only view and comment on alerts in their own repositories and never dismiss them.
- BDevelopers and the security team share one identical permission level, so any alert action one can take the other can take, with no way to differentiate.
- COnly the security manager role can dismiss alerts across the organisation, and developers with write access are limited to commenting on findings without ever changing an alert's state.
- DDevelopers with write access can triage and dismiss alerts in their repositories, while the security manager role gives a central team alert visibility and control of security settings across repositories. Correct
Why A is wrong: This overstates the restriction: developers with write access can typically triage and dismiss alerts in repositories they work on. Reserving every dismissal for organisation owners would make routine remediation unworkable, so this misrepresents the default permission model.
Why B is wrong: GitHub distinguishes capabilities by repository role and by the security manager role, so the two groups are not forced into identical permissions. Claiming there is no way to differentiate ignores the role-based controls that exist precisely to separate these duties.
Why C is wrong: This wrongly strips developers of the ability to act on their own findings. Write access already permits dismissing alerts, so restricting all state changes to the security manager role would block the day-to-day remediation developers are expected to perform.
Why D is correct: This matches the model: repository write access lets developers triage and dismiss their own findings, and the security manager role grants a central team visibility into alerts and control of security configuration across the organisation. The two roles together divide remediation from oversight.