Question

You are reviewing a colleague's Python automation script that authenticates to a RESTCONF endpoint. The script contains the line `PASSWORD = "C1sco12345"` near the top of the file, and the file is committed to a shared Git repository. During code review you are asked to remediate this in a way that meets secure coding secret-management requirements without breaking the automation running in a CI/CD pipeline. Which approach best satisfies these requirements?

Accepted Answer

Retrieve the secret at runtime from an environment variable populated by the pipeline's protected/masked variable store (or an external vault), and remove the value from the code.

Answer

Move the credential into a base64-encoded string constant in the script so it is not stored in plaintext, then commit the change.

Answer

Leave the password in the script but add the file to .gitignore so future commits do not track it.

Answer

Encrypt the whole repository at rest on the CI runner disk and keep the hardcoded credential in the source file.