Secret scanning scans your entire Git history[D] on all branches [E] present in your GitHub repository for secrets, even if the repository is archived. GitHub will also periodically run a full Git history scan for new secret types in existing content in public repositories where secret scanning is enabled [C, not A] when new supported secret types are added.
Additionally, secret scanning scans:
Descriptions and comments in issues
Titles, descriptions, and comments, in open and closed historical issues. A notification is sent to the relevant partner when a historical partner pattern is detected.
Titles, descriptions, and comments in pull requests
Titles, descriptions, and comments in GitHub Discussions Wikis

REST API endpoints for code scanning
OAuth app tokens and personal access tokens (classic) need the security_events or repos cope to use this endpoint with private or public repositories, or the public_repo scope to use this endpoint with only public repositories.

GitHub's Code scanning is a feature that analyzes the code in a GitHub repository to find security vulnerabilities and coding errors, providing alerts in the repository and offering tools to triage, prioritize, and fix issues. It acts as a Static Application Security Testing (SAST) tool, using engines like CodeQL to detect issues like SQL injection and Cross-Site Scripting (XSS), and can be triggered automatically on events like pushes and pull requests.

You can override the default behavior in your repository settings, by specifying the level of severities and security severities that will cause a pull request check failure.
Customizing your advanced setup for code scanning
You can customize how your advanced setup scans the code in your project for vulnerabilities and errors.
Who can use this feature?
Users with write access if advanced setup is already enabled
Example:
Defining the alert severities that cause a check failure for a pull request You can use rulesets to prevent pull requests from being merged when one of the following conditions is met:
A required tool found a code scanning alert of a severity that is defined in a ruleset.
A required code scanning tool's analysis is still in progress.
A required code scanning tool is not configured for the repository.

Managing pull requests for dependency updates
You manage pull requests raised by Dependabot in much the same way as other pull requests, but there are some extra options.
Who can use this feature?
Users with write access