Module 01 · Source and pipeline · 35 min · You are: Platform team
Secrets in Git
In this module
- You learn: Trace how a secret enters Git history and how rotation limits its value.
- You do: Run the repository scan, inspect the seeded canary rule and hook, remove the canary from history, rotate the lab value, and record S01.
- You end with: S01 has a test, prevention and detection evidence, and a rotation record.
Deleting a secret from the latest file does not erase old commits. Reduce what can be committed, detect it early, and rotate anything exposed.
Open this module in the interactive course to track progress.
Change journey practised: Surface → Test → Measure → Prove
Concepts
- Surface: a commit with an old token
- History keeps earlier file contents even after a later deletion.
- Trust boundary
- A scanner finding does not revoke a credential.
- Evidence
- Break it: a secret-shaped value returns in history
Files to know
Open them in your editor or on GitHub; the bullets say what to look at.
start/.gitleaks.toml(reference): Course reference file for this surface.- This is the control or seeded condition examined in this module. L5
start/.githooks/pre-commit(reference): The small lab fixture used for a bounded test.- This fixture makes the trust assumption visible. L3
Steps
1. Test: scan every ref for the fake token
Use the lab format only. A match in old history is evidence that the credential must be rotated, even after the current file changes.
cd devsecops-lab && gitleaks git --log-opts=--all --redact
Find the commit and path for every match. Do not print or reuse a real credential.
cd devsecops-lab && git log -p --all -- docs/secrets.yaml && git status --short
2. Measure and prove: block and rotate
Enable the local hook, run the CI scan, remove the fake value from every ref, and record the rotation in docs/secrets.yaml. Repeat the scan and set S01 to covered only when it is clean.
cd devsecops-lab && gitleaks git --log-opts=--all --redact && ./scripts/validate.sh
Simplified for the workshop
The reference repository is a local learning fixture. Canaries, package publishing and service endpoints are disposable and do not grant access to a real account.
The checks read repository files as data. They do not run learner scripts or install dependencies.
Break it on purpose: Evidence is a repeatable test result tied to an owner, commit and retest.
A teammate makes a small change to save time. Work out which trust assumption it changes before you run the test.
You practise: You practise tracing the cheapest path from an input to a capability and identifying an independent control.
1. Break it
cd devsecops-lab && git diff -- .github/ docs/
2. What you see
Expected: the proof is stopped at the intended boundary. You get a successful path or missing evidence. Read the workflow log and the register entry.
3. Fix it yourself
Restore the intended boundary and rerun the same test. Done when the unsafe path is refused, the evidence is recorded and the files pass the repository validator.
Hint 1
Name who controls the input and what privilege consumes it.
Hint 2
Follow the input to the first capability and remove that trust or privilege.
The fix
Use the test and the exact policy file named above; do not add a blanket permission.
cd devsecops-lab && ./scripts/validate.sh
After you fixed it: the five questions
- What failed?
- A trust boundary allowed untrusted input to reach a useful capability.
- How was it detected?
- The predicted result and observed log did not match; preserve the commit and workflow run as evidence.
- Who responds?
- The owner listed for this surface in docs/attack-surface.yaml.
- How is it corrected?
- Close the specific boundary and repeat the original test.
- How is it prevented?
- Keep a parse-only lab check and a review rule on the owning files.
Quiz
- Which question best identifies the cheapest path?
- Which accepted input reaches the most useful capability with the fewest prerequisites?
- Which scanner has the most findings?
- Which team owns the largest number of files?
- What does a passing signature prove?
- The named identity signed these bytes.
- The source code is harmless.
- The image has no known vulnerabilities.
- When is a surface covered?
- The same bounded test is refused and evidence names the control and owner.
- A scanner has no critical findings.
- A policy file exists in the repository.
Answers
- Which accepted input reaches the most useful capability with the fewest prerequisites? Attack paths follow trust and capability, not tool counts.
- The named identity signed these bytes. Signatures bind identity and bytes, not safety.
- The same bounded test is refused and evidence names the control and owner. Presence is not proof; retest the attack path.
Field note
I ask learners to write the expected signal before they run a test. It makes a control failure easier to tell from a test that never reached the boundary.