Infrastructure definitions and credential exposure are often discovered during a source scan, but they require different evidence and remediation from ordinary code findings.
IaC needs resource context
An infrastructure finding should identify the framework, resource, property, policy rule and expected secure configuration. File and line are helpful, but the deployment consequence is what makes the result actionable.
Secrets need a lifecycle
Removing a string from the current branch is not enough. Teams may need to revoke the credential, assess history, replace the deployment secret and verify that the old value no longer works. Reports should redact the value and retain only safe identifiers.
Baselines are not permanent exceptions
A baseline can distinguish existing exposure from a new regression. It should record scope, owner and review date. A changed fingerprint or expired decision should return to triage.
Dedicated views improve ownership
Developers, platform teams and security responders need different filters and actions. Treating IaC and secrets as named workflows makes policy, assignment and verification clearer while preserving their relationship to the repository scan.
Next step: Give every secret and IaC exception an owner, reason and expiry.