Leaked Secret Hunt
A public GitHub repo dump. Find the hardcoded API key an automated scanner would catch in minutes — before an attacker does.
A public repository dump containing a hardcoded API key. Automated scanners find these within minutes of a push, and so do attackers — this lab is about learning to see what they see.
How to use it
- Search the repository for credential patterns.
- Find the hardcoded key.
- Consider what it grants and what it would take to remediate.
What to take away
Deleting the commit does not help
Once pushed, a secret is compromised. Git history, forks, caches and scrapers all retain it. Rotate the credential — that is the fix, and the only one.
The usual hiding places
.env committed by accident, config files, test fixtures, CI definitions, and code comments. Also notebooks and Dockerfiles, which people forget are code.
Prevention beats detection
Pre-commit hooks and server-side secret scanning stop the push. Finding it afterwards means you are already rotating.
Frequently asked questions
What should I do if I have committed a secret?
Rotate it immediately — before rewriting history, before anything else. Then purge it from history and check the provider's logs for use you did not authorise.
How do I keep secrets out of repositories?
Environment variables or a secrets manager, a .gitignore that covers .env from day one, pre-commit scanning, and push protection enabled on the hosting platform.
Where this fits in the course
This security lab pairs with Path 22 — DevSecOps & AppSec — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Secure Code Review Toy — Paste a code snippet and get flagged patterns — eval, string-built SQL, hardcoded secrets. Not a real SAST tool, but trains the eye.
- Entropy Calculator — Shannon entropy of any text — a genuine static-analysis signal for spotting packed or encrypted data.
- Cloud IAM Misconfig Playground — A role holds one deceptively small permission. Chain it into full account takeover through iam:PassRole.
- Docker Escape Playground — A container mounts the host's Docker socket. Use it to spin up a privileged container and step onto the host itself.