Question

You are a security admin for an enterprise GitHub organization with 300 repositories. Leadership wants a governance approach that guarantees Secret Protection features (secret scanning and push protection) remain enabled on every current repository AND automatically applies to any new repository created in the future, without requiring developers to remember to turn them on. Which approach best satisfies this requirement?

Accepted Answer

Configure an organization-level security configuration (or the equivalent org security settings) that enables secret scanning and push protection, and apply it as the default so it attaches to newly created repositories automatically.

Answer

Enable secret scanning and push protection individually on each of the 300 repositories through their repository security settings.

Answer

Add a branch protection rule requiring status checks so that secrets are blocked before merge on all repositories.

Answer

Instruct all developers to add a pre-commit hook that runs a local secret scanner before every push.