A retail platform team uses a shared CI/CD system where any developer can edit pipeline definitions in the same repository as application code. During an incident review, the team discovered that a junior developer had modified the deployment job to bypass the static analysis gate so a release could ship. As security architect, what is the BEST corrective control to recommend?
- AProvide additional secure coding training to all developers and add a section on the importance of static analysis to the team onboarding deck.
- BConfigure the static analysis tool to send a notification to the security team whenever a scan is skipped or returns no findings in the pipeline run.
- CRequire developers to run the static analysis tool locally and paste the clean report into the merge request as evidence before approval.
- DMove pipeline definitions to a protected repository with branch protection, signed commits, and mandatory review by a separate platform engineering team before merge. Correct
Why A is wrong: Training raises awareness but is a soft control that does not prevent a determined or pressured developer from editing the pipeline; the incident showed a technical control gap, not a knowledge gap.
Why B is wrong: Alerting on bypass is a detective control that fires after the release has already shipped; it improves visibility but still permits unscanned code to reach production and is therefore weaker than preventing the bypass.
Why C is wrong: Local scans are trivially forged or run against stale code and rely on developer honesty; they do not provide the assurance of a centrally enforced pipeline gate and reintroduce the very weakness the incident revealed.
Why D is correct: Separating pipeline-as-code from application code, enforcing branch protection, and requiring independent review establishes segregation of duties so a single developer cannot disable security gates without detection.