WrongSecrets
An OWASP training app with 62 challenges demonstrating real-world secrets management mistakes and how to find them.
What is WrongSecrets?
OWASP WrongSecrets is an open-source training application that demonstrates 62 common ways secrets can be accidentally exposed in software. It provides hands-on challenges where users must find intentionally hidden secrets using various security tools and techniques. The project helps developers and security teams recognize vulnerabilities in their own secrets management practices.
Security engineers, DevOps practitioners, and developers who want to improve their understanding of secrets management vulnerabilities and learn practical detection techniques. It's also valuable for teams running security training workshops or Capture The Flag (CTF) events.
Unlike theoretical guides, WrongSecrets offers practical, hands-on challenges across multiple environments (Docker, Kubernetes, cloud platforms). It's maintained under OWASP with real-world scenarios and serves as both a training tool and a benchmark for secret detection tools.
Overview
Vulnerable app with examples showing how to not use secrets
Use Cases
Best For
- Running internal security training workshops on secrets management
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
