Question

A security engineer at a fintech company receives a secret scanning alert indicating a valid cloud provider API key was committed to a private repository three weeks ago. The commit history shows the key has been present across multiple branches and was pushed before push protection was enabled. According to GitHub's recommended response workflow, what should the engineer do FIRST to properly respond to this alert?

Accepted Answer

Revoke the exposed API key with the cloud provider and issue a new one, then remediate the alert in GitHub

Answer

Rewrite the repository's Git history to purge the key from all branches before taking any other action

Answer

Dismiss the alert as 'used in tests' since the key was committed before push protection was active

Answer

Enable push protection on the repository to prevent the key from being exposed again