Push Protection for Secrets is primarily concerned with preventing commits to which branch when a secret is identified?

• A. Main branch
• B. Feature branch
• C. Develop branch
• D. Release branch

Answer: (A)

Push Protection for Secrets targets stopping sensitive credentials from entering the production code path. The main branch is typically the default, most protected, and the branch that represents release-ready code. If a secret sneaks into main, it can end up in release artifacts, CI logs, and distributed code, exposing credentials to a wide audience. By blocking commits that contain secrets to the main branch, the system enforces removing the secret before it can contaminate the stable codebase. This encourages rotating the secret and pushing a clean update, while development can continue on other branches without immediate blockage. In short, the main branch is the primary guardrail because it’s the version of the code most likely to be deployed and shared, so preventing secrets there minimizes exposure risk.