Question

A DevSecOps team stores database passwords, API keys, and TLS private keys directly as plaintext variables inside their Jenkins pipeline configuration files, which are committed to a shared Git repository. A security review flags this practice. Which approach best remediates the risk while supporting the CI/CD pipeline's need to authenticate to downstream services at build time?

Accepted Answer

Integrate a centralized secrets management vault that dynamically injects short-lived credentials into the pipeline at runtime and never stores them in the repository

Answer

Base64-encode the credentials before committing them to the Git repository so they are no longer human-readable

Answer

Move the pipeline configuration files to a private repository and restrict Git access with branch protection rules

Answer

Rotate the plaintext credentials on a weekly schedule using a scheduled build job