Question

A developer at Contoso commits a Python file that both (1) contains an active AWS access key hardcoded in a variable and (2) constructs a SQL query by concatenating unsanitized user input. The security team wants each issue surfaced by the GitHub Advanced Security capability that is purpose-built to detect it. Which pairing correctly maps each issue to the appropriate capability?

Accepted Answer

The AWS access key is caught by Secret Protection (secret scanning), and the SQL injection risk is caught by Code Security (CodeQL code scanning).

Answer

Both issues are caught by Secret Protection, since credentials and injection patterns are both treated as leaked secrets.

Answer

Both issues are caught by Code Security (CodeQL), since it performs full static analysis including credential detection.

Answer

The AWS access key is caught by Supply Chain Security (Dependabot), and the SQL injection risk is caught by Secret Protection.