OWASP WrongSecrets is the first Secrets Management-focused vulnerable/p0wnable app! It can be used as a stand-alone game, as part of security trainings, awareness demos, as a test environment for secret detection tools, and bad practice detection tooling. It even has a supporting CTF platform to play the game in a larger group.
Want to give it a shot? Go to our demo environment running on Heroku.
WrongSecrets is based on Java, Docker, Terraform, and a bit of scripting fun. It contains more than 50 exercises with various wrongly stored or misconfigured secrets - which you need to find. Finding these secrets will
Help you to look for secrets being misconfigured at your own environment, or target environments for bug bounties.
Help you to re-evaluate your own secrets management practices as well.
New to WrongSecrets? Start here:
Try Online First: Visit our Heroku demo to get familiar with the challenges
Run Locally: Use Docker for the full experience with all challenges:
docker run -p 8080:8080 -p 8090:8090 jeroenwillemsen/wrongsecrets:latest-no-vaultThen open http://localhost:8080
Want to see what's ahead? Try our bleeding-edge master container with the latest features:
docker run -p 8080:8080 -p 8090:8090 ghcr.io/owasp/wrongsecrets/wrongsecrets-master:latest-master⚠️ Note: This is a development version and may be unstable
Advanced Setup: For cloud challenges and Kubernetes exercises, see the detailed instructions below
What you'll learn:
Common secrets management mistakes
How to identify exposed credentials
Best practices for securing secrets
Tools and techniques for secret detection
How it works: This repository contains intentionally vulnerable code and configuration files with real and fake secrets hidden throughout the codebase. You'll examine source code, configuration files, Docker containers, and cloud deployments to discover these secrets. Each challenge teaches you different ways secrets can be accidentally exposed in real-world applications.
Leaders:
Top contributors:
Contributors:
Testers:
Translators:
Special thanks:
We would like to thank the following parties for helping us out:
GitGuardian for their sponsorship which allows us to pay the bills for our cloud-accounts.
Jetbrains for licensing an instance of Intellij IDEA Ultimate edition to the project leads. We could not have been this fast with the development without it!
1Password for granting us an open source license to 1Password for the secret detection testbed.
AWS for granting us AWS Open Source credits which we use to test our project and the Wrongsecrets CTF Party setup on AWS.
This program is free software: You can redistribute it and/or modify it under the terms of the AGPLv3 License. OWASP WrongSecrets and any contributions are Copyright © by Jeroen Willemsen & the OWASP WrongSecrets contributors 2020-2026.
You can help us in many ways:
Star us on github: OWASP/WrongSecrets
Promote us using Twitter/Mastodon.
Promote us with a Blog, Vlog, Podcast, or presentation on a conference. Or use our materials to organize a CTF! If you do, let us know, so we can list your event or publication here on the webiste.
Work with us on the project! Take a look at the Readme of the project, How to contribute, and the Github Issues. If you want to contribute to an issue: make sure it is not yet assigned to someone, comment on it with your intention, and then we can assign it to you.
Sponsor our project! We will use the money for covering our cloud costs (building & maintaining the project in 3 clouds costs money). And soon we hope to be able to buy you some stickers if you do ;-).
The project has been promoted at:
AllDayDevOps: Our secrets management journey from Code to Vault
Conf42 DevSecOps 2021: Secrets-management: challenges from code to cloud
OWASP Dutch Chapter Meetup: Our Secrets Management Journey: From Code to Vault
WrongSecrets demo - How not to store secrets with the project founder Jeroen Willemsen
Security Journey: Jeroen Willemsen and Ben de Haan - Dirty little secrets
Meetup OWASP Bay Area: OWASP WrongSecrets: how to NOT mange your secrets
Code to Cloud Virtual Summit: Learn How to (Not) Use Secrets with OWASP WrongSecrets!
Devops Pro Europe: Introducing OWASP WrongSecrets: How You Should NOT Handle Your Secrets
OWASP Virtual Appsec Europe 2022: OWASP WrongSecrets: We have a secret for Everyone!
OWASP Hamburg Stammtich
DevSecOps Days 2022 Washington DC (Virtual): Learn How To (Not) Use Secrets With OWASP Wrong Secrets! and see the Youtube recording here
AllDayDevOps - Learn how to (not) use secrets with OWASP WrongSecrets!
Azure Cloud Security Meetup: Cloud-Native Secrets Management with OWASP WrongSecrets by Dan Gora
OWASP Benelux Days 2022 - CTF Kickoff with actual CTF info
Open Security Summit: OWASP WrongSecrets a journey into secrets management
Open Security Summit: OWASP WrongSecrets: Define the future challenges togeter
Cyberwisecon: OWASP WrongSecrets: How We Keep on Growing Our Open Source Project
NLUUG: How to (not) Use Secrets with OWASP WrongSecrets recording from From 2:13
ADDO: OWASP WrongSecrets: How We Keep on Growing Our Open Source Project
Coverage on youtube: walkthrough by sec right
Various Blogs: A blog by Gitguardian, Another blog by Gitguardian, Blogs by the author(s), A blog by Okteto, A blog by Nec, A blog from vineeth.dj.
Various Podcasts: Application Security Podcast: Jeroen Willemsen & Ben de Haan – Dirty little secrets, Devsec for scale: Secrets Management Pt 1, Devsec for scale: Secrets Management Pt 2, Devsec for scale: Secrets Management Pt 3.
We would like to thank many people that have given a shoutout or a share about this project! Thank you for your forum-posts, blogs, and more!
Project Resources
Major Contributors
Recognizing key contributors who have made significant impact on this project.
Project Information
Slack