WrongSecrets: We Have a Secret for Everyone!
summary
A runnable vulnerable app plus a secret-detector testbed exists on Heroku and GitHub and currently contains 18 challenges that exercise real failures: a Docker Hub image layer exposes a command-line password, GitHub Actions logs leak secrets via double-encoded base64 bypasses, and history-scans with truffleHog recover committed AWS keys. Canary tokens visibly trigger alerts when exfiltrated. The demo shows these attacks work end-to-end, the project ships frequent releases, and the roadmap adds binary reverse‑engineering challenges and continued multi‑cloud support.
AI-written summary · about
chapters (7)
- 0:00Start
- 3:13Examples of secrets
- 6:00Can you tell us
- 7:51What is it?
- 10:22Overall architecture
- 32:21A few takeaways
- 35:57Questions?
related talks
33mGaining initial access by exploiting leaked credentials
38mAdventures in Cloud Security: What DevOps Can Learn from a Security Engineer
31mExploiting Leaked Credentials - How python code is leaking millions of secrets
31mThe internet is broken: breaking down the software supply chain
35mGit those secrets out your repos!
40mDue to Less Pollution, Secrets Stored on the Cloud are Now Clearly Visible
28mFresh Secrets From the Docks: Lessons Learnt From Analyzing 180,000 Public DockerHub Images
56mDiscover the Art of Managing Secrets as a Software Engineer.