A team wants its CI pipeline to stop a build when someone commits an API key or a connection string into the repository. Which kind of tool should it add?
Show answer and explanation
Answer: C
Secret scanners compare source files and commits against patterns for credentials such as keys, tokens and connection strings. When a match is found, the pipeline can fail the build and block the change from moving forward. Unit tests check functional behavior, profilers measure runtime cost, and network scanners look at hosts rather than the contents of code. Only a dedicated scanner addresses leaked secrets in the repository.
Why the other options are wrong
- A. Unit tests verify business logic and would not notice a credential string sitting in a configuration file.
- B. A profiler measures runtime performance such as memory and CPU, so it has no way to detect a secret committed to the repository.
- D. A network scanner inspects hosts and open ports on the agent, not the text stored in source files or commit history.