Explanations for `sender` field of CodeScanningAlert

Hi,

I’m contacting you because I’d like to confirm some details about the CodeScanningEvent webhook payload.

In the docs it says that the sender property is github for the created, fixed, reopened actions.
But, what are the values for the sender property?
Currently the example uses the values from the GET /orgs/github REST endpoint while the other webhooks use similar values to the GET /user/github REST endpoint

We had one staffer send us a PR (octokit/webhooks#366) with some example payloads with the sender property using the GET /orgs/github REST endpoint and then just recently we have another staffer sending more payload examples (octokit/webhooks#371) using values similar to the GET /user/github REST endpoint

What I am asking is, which one is correct
Greatly appreciated if someone could clarify this

ref: octokit/webhooks#379