A clerk-automation pipeline serializes “quick demo” models whose metadata fields embed live API keys. What pipeline control should catch this?
Select an answer to reveal the explanation.
Short Explanation
API keys stuffed into model metadata are passwords hidden in the shipping label. Scan artifacts for secrets before they hit the registry. Pasting keys on purpose, skipping “demo” scans, and public demo publishes spread the leak.
Full Explanation
A clerk-automation pipeline that serializes “quick demo” models whose metadata fields embed live API keys needs scanning of model artifacts for embedded secrets before registry publish. Credentials in metadata travel with every copy of the artifact—registries, caches, laptops, and partner shares. Demo labeling does not reduce risk once the file leaves a workstation. Secret scanning at the publish boundary catches keys the same way application pipelines catch secrets in containers or packages.
Encouraging engineers to paste keys into metadata for easier debugging fails because it institutionalizes secret sprawl. Skipping artifact scans for any file labeled demo fails because attackers and accidents ignore labels. Publishing demo models to a public registry for community feedback fails because it can disclose live municipal API keys to the world.
Exam caveat: “demo” is not a security boundary; artifact secret scanning before registry publish is.
Operational check: enable pre-publish secret scanners on model packages and sidecars; fail publish on detections; rotate any keys found in demo metadata; prohibit public registry push for clerk-automation artifacts containing municipal credentials.