Credentials are leaked and are rotated


An external employee has cloned the code from the internal repository and pushed the full code base to Github. Unfortunately the codebase also contained credentials to the SQL Server. Because the credentials pointed to a PartsUnlimited Azure subscription, the Azure Administrator received an email. In panic, he rotated the credentials of the SQL Server Users that is used in the connection string, not thinking of the consequences. You need to fix this! And fast.

Learning objectives

In this challenge you will learn all about

  • Credential Scanner in the pipeline
  • Add required Reviewers for code changes and apply branch policies
  • Add Application Insights Detection
  • Add an Azure Monitor Alert
  • Use secrets in the pipeline with keyvault
  • Suppress false positives for the credential scanner