Question

A fintech team runs a Node.js payment service. During a single sprint, two problems surface: (1) a developer accidentally commits an AWS access key to a feature branch, and (2) a code review reveals a SQL query built by concatenating untrusted user input. The security lead wants to use the GitHub Advanced Security suites so that each problem is handled by the tool actually designed to address its root cause. Which mapping correctly assigns each issue to the appropriate suite and reflects why they are distinct but complementary?

Accepted Answer

Secret Protection handles the leaked AWS key (detecting/blocking exposed credentials), while Code Security handles the SQL injection flaw (analyzing source for vulnerable coding patterns) — they address different root causes and work together across the SDLC.

Answer

Code Security handles both issues, since a leaked credential and an injection flaw are both code-level defects that code scanning queries will detect.

Answer

Secret Protection handles both issues, because scanning for credential patterns will also flag insecure string concatenation used to build queries.

Answer

Supply Chain Security handles the leaked AWS key via Dependabot, and Code Security handles the SQL injection flaw via dependency review.