Question

A DevSecOps team wants to prevent developers from committing hardcoded API keys and database passwords into the source repository. Occasionally these secrets are discovered only after they have been deployed to production, forcing emergency credential rotation. Which control most effectively addresses this problem as early as possible in the pipeline?

Accepted Answer

Integrate automated secret-scanning with pre-commit hooks and a pipeline gate that blocks builds when secrets are detected

Answer

Deploy a runtime web application firewall (WAF) that inspects outbound traffic for credential patterns

Answer

Require quarterly manual code reviews by the security team before any release to production

Answer

Encrypt the entire source code repository at rest and restrict access to authorized developers