Question

Your team stores its source in Azure Repos. Leadership is concerned that developers occasionally commit API keys and connection strings, and they want any exposed credentials detected automatically without requiring developers to run local tools. You have enabled GitHub Advanced Security for Azure DevOps on the repositories. Which capability of GitHub Advanced Security for Azure DevOps detects secrets that already exist in the commit history and repository content after code is pushed?

Accepted Answer

Secret scanning (repository scanning) that inspects pushed content and history for known credential patterns

Answer

Push protection that blocks the commit at the client before it reaches the server

Answer

Dependency scanning that flags vulnerable open-source packages in the manifest files

Answer

Code scanning powered by CodeQL that analyzes source for security anti-patterns