A fintech startup hosts Python code in GitHub repositories and must block merges when secrets or critical vulnerabilities appear, with findings visible to developers in pull requests. Which pipeline security tool configuration should the platform engineer implement to discover vulnerabilities during code review?
Select an answer to reveal the explanation.
Short Explanation
You’re putting a metal detector on the conveyor belt. Scanning with Amazon Inspector code security catches secrets and flaws in pull requests, and branch protection keeps risky code from shipping.
Full Explanation
Amazon Inspector code security is the right configuration because it scans Python application code when a pull request is opened, surfaces findings for developers during review, and works with branch protection to block merges until critical issues are resolved. This meets the requirements for discovery during code review, developer visibility, and enforced remediation. Amazon CodeGuru Security scans with inline pull-request comments can guide developers to fix secrets, but without enforced merge blocking rules, a pull request can still be merged with unresolved findings. Inspector code security that sends notifications only to Security Hub dashboards can scan code and block merges, but dashboard-only notifications fail to show findings to developers in pull requests during review. Inspector container image scans can block merges until critical base-image CVEs are resolved, but they examine container images rather than Python source code, so they do not discover source-level secrets and code vulnerabilities. Exam caveat: distinguish scan trigger and artifact scope; scans after a merge cannot prevent that merge, and image scans do not substitute for code scans. Practical check: verify the GitHub connection, required branch-protection status check, critical-severity threshold, and a test pull request that confirms findings appear during review and block merging until resolved.