OWASP / OWASP/wrongsecrets

Have a challenge with a backup bucket containing the secret

Open
#982 15 comments 0 reactions 1 assignee View on GitHub

@AAYUSH-SPIDEY-SHARMA is already working on this.

Since Feb 5, 2025.

help wanted New Challenge
Dominant language
HTML
Stars
1.5k
Forks
625
Avg merge
14h 21m
Merged PRs (30d)
44

Description

Context
  • What should the challenge scenario be like?
    Have a backup s3/storage bucket with a private ed25519 key publicly exposed
  • What should the participant learn from completing the challenge?
    Secure your backup at all cost
  • For what category would the challenge be? (e.g. Docker, K8s, binary)
    Docker/cloud depending on how we implement the backup solution

Actions:

  • create separate Terraform folder to have an S3 bucket (in our AWS folder) under the name "backupchallenge"
  • have the key copying logic in a shell script using AWS CLI as part of the backupchallenge folder
  • implement the challenge according to contributing.md and make sure you hide the key in your classfile.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.