Question

A platform engineering team is designing an end-to-end secure SDLC using the GitHub Security suites. They want each suite mapped to the phase where it delivers the most value. Which mapping correctly reflects the primary role of each suite across the development lifecycle?

Accepted Answer

Secret Protection blocks credentials at commit/push time, Code Security analyzes code for vulnerabilities during development and PR review, and Supply Chain Security tracks vulnerable dependencies introduced by third-party components.

Answer

Code Security blocks credentials at commit time, Secret Protection scans running production code for logic flaws, and Supply Chain Security enforces branch protection rules before deployment.

Answer

Supply Chain Security scans source code for injection flaws, Code Security manages leaked API keys in git history, and Secret Protection generates the dependency graph and Dependabot updates.

Answer

All three suites operate only at deployment time as release gates, and none provide value during earlier coding or commit phases.