OWASP WrongSecrets

Secret in a closed github issue

A user accidentally reveals the new AWS Secret key in conversation between him and his friend in a GitHub issue.

Can you spot the secret in our GitHub repository?

🔑 Enter the secret you found: 💡 Tip: Secrets are often strings, numbers, or encoded values. Copy and paste exactly what you find.

💡 Show Hints 🔍 What's Wrong?

We are looking for the secret in a closed GitHub issue in our GitHub repository. But how do we find it?

You can solve this challenge by the following steps:

When you land on the issues tab of our GitHub, click on the Closed option to get all the closed issues up to this day
Go through all the issues that seem fishy for you and you can spot the Secret.

Why storing secrets in closed GitHub issue is a bad idea?

Do not put secrets in issues. Issue visibility depends on repository settings, and closing an issue does not erase its history or copies. Share necessary details through an approved, access-restricted disclosure channel instead.

Review issue content before posting. If a credential is disclosed, revoke or rotate it immediately and remove the exposed content where possible.

🔍 Your Task

Secret in a closed github issue

Congratulations!