Which combination of practices helps prevent secrets from being committed?

• A. Use environment vars, GitHub Actions Secrets, pre-commit checks, and secret scanning in CI
• B. Use manual audits after commit
• C. Use only local env vars
• D. Store secrets in code

Answer: (B)

Prevent secrets from entering a repository by stopping them before they’re ever committed and by handling them securely in your automation workflow. Using environment variables and storing secrets in GitHub Actions Secrets keeps credentials out of the codebase and out of the repository history. Layer on pre-commit checks that scan for secret patterns and block commits that contain them, plus secret scanning in CI that detects secrets in pull requests or any code that slips through. This combination creates multiple prevention points and catches leaks early, reducing the chance secrets are ever exposed.

Relying on audits after a commit is too reactive: once a secret is committed, it can live in the repo history, potentially be exposed to collaborators or attackers, and require costly remediation. Storing secrets directly in code or depending only on local environment variables also risks leakage, since those values can be committed or inadvertently shared. The strongest approach is a defense-in-depth strategy that prevents secrets from being committed and manages them securely in the automation workflow.