In credential security, prevent refers to controls that stop secrets from being exposed in the first place. Instead of waiting to discover a leaked API key, token, or password, preventive controls try to block unsafe actions before they reach source code, chat tools, tickets, build logs, or shared documents. Common examples include pre-commit hooks, CI/CD secret scanning, policy enforcement, approved secret managers, and limits on secret reuse.
Prevent matters because exposed credentials are often usable immediately by attackers. Once a secret is committed to a repository or copied into an automation workflow, it can spread quickly and become hard to fully remove. In practice, preventive defenses reduce that risk by catching secrets at creation time, enforcing rotation and expiration, and requiring safer authentication patterns such as short-lived tokens or non-human identities. In modern security programs, prevention complements detection and remediation by reducing the number of leaks that ever become incidents.