Question

A platform security engineer is designing the rollout of Secret Protection for an organization. Leadership wants to guarantee that most new credentials never reach the default branch history, while also ensuring that credentials already committed in the past are surfaced for remediation. Which combination of Secret Protection capabilities correctly maps to these two distinct goals?

Accepted Answer

Push protection prevents new secrets from being committed at push time, while secret scanning detects secrets already present in the repository's existing history.

Answer

Secret scanning blocks secrets at push time, while push protection retroactively scans commit history for previously leaked credentials.

Answer

Push protection scans the existing default branch on a schedule, while secret scanning enforces a pre-commit hook on developer machines.

Answer

Both goals are met solely by push protection, since it scans all historical commits whenever a new push occurs.