Question

You are a security lead onboarding a new team to GitHub Advanced Security. A developer asks you to clarify which GitHub security suite is responsible for detecting hardcoded API tokens accidentally committed to a repository, as opposed to flagging a SQL injection pattern in application source code. How should you correctly distinguish the two suites and their responsibilities?

Accepted Answer

Detecting the hardcoded API token is handled by Secret Protection, while identifying the SQL injection pattern is handled by Code Security.

Answer

Both the API token and the SQL injection pattern are detected by Supply Chain Security, since both relate to external inputs.

Answer

Detecting the hardcoded API token is handled by Code Security's code scanning, while the SQL injection pattern is flagged by Secret Protection.

Answer

Both issues are exclusively handled by Dependabot as part of dependency review before merge.