{"repo":"OWASP/wrongsecrets","free":true,"listed":false,"github":"https://github.com/OWASP/wrongsecrets","clone":"git clone https://github.com/OWASP/wrongsecrets.git","description":"Vulnerable app with examples showing how to not use secrets","language":"Java","stars":1457,"topics":["hashicorp-vault","terraform-aws","java","kubernetes","secrets","secrets-management","vault","devsecops","security","aws"],"license":"AGPL-3.0","category":"security-tools","readme_excerpt":"OWASP WrongSecrets Welcome to the OWASP WrongSecrets game! The game is packed with real life examples of how to not store secrets in your software. Each of these examples is captured in a challenge, which you need to solve using various tools and techniques. Solving these challenges will help you recognize common mistakes & can help you to reflect on your own secrets management strategy. Can you solve all the 67 challenges? Try some of them on our Heroku demo environment. Want to play the other challenges? Read the instructions on how to set them up below. 🚀 Quick Start New to WrongSecrets? Start here: 1. Try Online First : Visit our Heroku demo to get familiar with the challenges 2. Run Locally : Use Docker for the full experience with all challenges: Then open http://localhost:8080 3. Want to see what's ahead? Try our bleeding-edge master container with the latest features: ⚠️ Note: This is a development version and may be unstable 4. Advanced Setup : For cloud challenges and Kubernetes exercises, see the detailed instructions below What you'll learn: - Common secrets management mistakes - How to identify exposed credentials - Best practices for securing secrets - Tools and techniques for secret detection How it works: This repository contains intentionally vulnerable code and configuration files with real and fake secrets hidden throughout the codebase. You'll examine source code, configuration files, Docker containers, and cloud deployments to discover these secrets. Eac","default_branch":null,"files":null,"tree":[],"storefront":"/r/OWASP","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/OWASP/wrongsecrets/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}