Assuming security and analysis features are not configured at the repository, organization, or enterprise level,...

By default,secret scanning is enabled automatically for all public repositories. For private or internal repositories, secret scanning must be enabled manually unless configured at the organization or enterprise level.

This default behavior helps protect open-source projects without requiring additional configuration.