Question

During a code review of a CI/CD pipeline, a security analyst discovers that developers have embedded database passwords and API keys directly in application source code stored in the Git repository. The organization wants to adopt SecDevOps practices to remediate this without slowing down deployments. Which recommendation best addresses this issue?

Accepted Answer

Integrate a secrets management vault and inject credentials at runtime via environment variables or short-lived tokens

Answer

Encrypt the entire Git repository at rest and restrict repository access to senior developers only

Answer

Rotate all embedded credentials every 30 days while leaving them in the source code

Answer

Add the credentials to a .gitignore file so they are excluded from future commits