A school district's CI/CD pipeline for model-training code needs an automated check that catches insecure code patterns before the code is deployed. What should the pipeline add?
Select an answer to reveal the explanation.
Short Explanation
Catching a bad habit in code review is cheaper than catching it in production, the same way a spellchecker beats a printed typo. An automated security scan built into the pipeline flags the issue while it's still just a pull request. Waiting for a quarterly human pass lets a lot slip through in between.
Full Explanation
Building an automated security scan into the CI/CD pipeline means every code change is checked for known insecure patterns before it merges or deploys, catching issues while they're cheap to fix and before they ever reach production — this is what an automated, pipeline-integrated review step provides that manual review cannot match for coverage or speed. A quarterly manual review only samples a slice of the changes that shipped in between, leaving most commits unreviewed for security issues for months at a time. A code-formatting step improves readability and consistency but does not evaluate logic for security flaws — a perfectly formatted file can still contain an insecure pattern. Compressing the training script before upload is a storage or transfer optimization with no relationship to whether the code itself contains a vulnerability. Scope caveat: an automated scanner catches known patterns and common classes of issues — it isn't a substitute for reviewing logic-level or business-context risks a human reviewer might still need to weigh in on. Operational check: confirm the pipeline actually fails the build (not just warns) when the scan flags a genuine issue, so the control is enforced rather than advisory.