A platform team wants to detect secrets accidentally committed to a Git repository before they are pushed to the remote server. Which practice most directly addresses this at the earliest possible point?

Question

Accepted Answer

B. Using pre-commit hooks with a secrets scanning tool to intercept commits locally before they reach the remote. Pre-commit hooks with secrets scanning tools such as Gitleaks or detect-secrets intercept commits locally before they reach the remote repository, catching accidentally committed secrets at the earliest possible point. Running scanning only in CD catches issues much later, after secrets may already exist in source control history. GPG signing authenticates commit authorship but does not scan for sensitive content.

A platform team wants to detect secrets accidentally committed to a Git repository before they are pushed to the remote server. Which practice most directly addresses this at the earliest possible point?

Related Questions

Discussion