Question

A platform security lead wants to reduce the number of secret-scanning alerts that reach the triage queue by stopping credentials from ever entering the repository. Developers report that most leaks happen when they commit and push local config files containing API keys. Which combination of measures best embodies a 'shift-left' preventive approach for this specific problem, rather than a detect-and-remediate approach?

Accepted Answer

Enable push protection for secret scanning so pushes containing recognized secrets are blocked before they enter the repository history

Answer

Increase the frequency of scheduled secret-scanning runs so leaked keys are detected sooner after they are committed

Answer

Create a security campaign to bulk-assign existing secret-scanning alerts to the developers who introduced them

Answer

Configure secret-scanning alert notifications to route to the security team so they can revoke exposed keys faster