City security wants SAST and secret scanning on repositories that define GenAI prompts and MLOps infrastructure-as-code. What practice does this extend?
Select an answer to reveal the explanation.
Short Explanation
Prompt packs and pipeline IaC are still code — scan them like any other city repo. Extend DevSecOps scanners to GenAI/MLOps trees. Banners, skipping signatures, and “containers only” leave the source side blind.
Full Explanation
When city security wants SAST and secret scanning on repositories that define GenAI prompts and MLOps infrastructure-as-code, the practice being extended is DevSecOps scanning applied to GenAI and MLOps codebases. Prompt packs, RAG configs, training DAGs, and IaC are still code: they can embed secrets, unsafe defaults, and supply-chain risks. Treating them as exempt “AI special files” creates blind spots. Extending the same scanner classes used for application repos closes that gap without inventing a parallel, unenforced process.
Replacing all static scans with longer acceptable-use banners fails because policy text does not detect hardcoded keys or insecure IaC. Allowing unsigned commits if the author works in the AI team fails because team affiliation is not integrity proof. Scanning only production containers and never source repositories fails because secrets and misconfigurations often originate in source and prompt repos before any image is built.
Exam caveat: GenAI assets inherit DevSecOps—do not accept distractors that substitute banners, trust-by-role, or container-only scanning for repository SAST/secret detection.
Operational check: onboard prompt and MLOps IaC repos to the city’s SAST and secret-scan platform; fail merges on high-severity findings; sample recent AI-team commits for unscanned paths; verify scanners cover YAML/JSON/IaC and notebook-exported pipeline definitions.