Explanation:
Box 1: CONFIGURATION_ID \
The GitHub REST API endpoint to set a code security configuration as the default for an enterprise or organization uses the format PUT /enterprises/{enterprise}/code- security/configurations/{configuration_id}. Using CONFIGURATION_ID correctly specifies the particular configuration being marked as default, while providing the body payload
{"default_for_repos":"all"} to indicate that it applies automatically to all new repositories.
Incorrect:
CONFIGURATION_ID/defaults: This syntax is incorrect because /defaults is not part of the path configuration URL schema when marking an individual configuration as the repository default CONFIGURATION_ID/policy: This path is invalid. Custom security policies are handled separately, and the configuration-specific setting does not append /policy to the target URI.
default/configurations: This ordering reverses the standard collection-resource layout of GitHub's REST endpoints, which always begins with the base collection /code-security/configurations/ followed by an identity indicator.
Box 2: all
Setting default_for_repos to "all" ensures that the given code security configuration becomes the automatic default applied to all newly created repositories across the enterprise/organization scope.
Reference:
https://docs.github.com/rest/code-security/configurations

Using a custom configuration file
A custom configuration file is an alternative way to specify additional packs and queries to run.
You can also use the file to disable the default queries, exclude or include specific queries, and to specify which directories to scan during analysis.
The configuration file can be located within the repository you are analyzing, or in an external repository. Using an external repository allows you to specify configuration options for multiple repositories in a single place.

The best way to prioritize secret scanning alerts is to filter by active secrets --- these are secrets GitHub has confirmed are still valid and could be exploited. This allows security teams to focus on high-risk exposures that require immediate attention.

Adding a security policy to your repository
You can give instructions for how to report a security vulnerability in your project by adding a security policy to your repository.
About security policies
To give people instructions for reporting security vulnerabilities in your project, you can add a SECURITY.md file to your repository's root, docs, or .github folder. Adding this file to this part(s) of your repository automatically creates a row with a description where people can review it.
When someone creates an issue in your repository, they will see a link to your project's security policy.
You can create a default security policy for your organization or personal account.

Viewing and filtering alerts from secret scanning
Who can use this feature?
Repository owners, organization owners, security managers, and users with the admin role Note: About the secret scanning alerts page When you enable secret scanning for a repository or push commits to a repository with secret scanning enabled, GitHub scans the contents for secrets that match patterns defined by service providers.
When secret scanning detects a secret, GitHub generates an alert. GitHub displays an alert in the Security tab of the repository