Cheat notes · Module 01 · Source and pipeline
Secrets in Git
A five-minute review for when you have done this module and want it back in your head. Open the full module for the steps and the lab, or the full text to print.
The idea
Trace how a secret enters Git history and how rotation limits its value. S01 has a test, prevention and detection evidence, and a rotation record.
Remember
- Surface: History keeps earlier file contents even after a later deletion.
- Trust: A scanner finding does not revoke a credential.
- Evidence: Break it: a secret-shaped value returns in history
- Owner: keep one team accountable for the control and the retest.
Pitfalls
- A green workflow does not prove the artifact or its inputs are trustworthy.
- A policy file does not prove that the same attack path is stopped.
Commands
./scripts/validate.sh | Check the evidence files are present without running learner code. |
git log --oneline -5 | Trace recent changes that may affect the path. |
Test yourself
Answer in your head first, then open the answer.
What is the objective?
History keeps earlier file contents even after a later deletion.
What do you test?
Run the repository scan, inspect the seeded canary rule and hook, remove the canary from history, rotate the lab value, and record S01.
What proves the control holds?
S01 has a test, prevention and detection evidence, and a rotation record.
Where module 01 leaves you: S01 has a test, prevention and detection evidence, and a rotation record.