Lion Cipher Lab
Find leaked secrets in your own code with gitleaks
- AppSec / DevSecOps
- Beginner
- ~30 min
- Free · no account required
Why it matters
Hardcoded secrets -- API keys, database passwords, access tokens, private keys -- are one of the most common ways real organizations get breached. Someone drops a credential into the code, commits it, pushes to GitHub, and now automated scanners run by attackers can find it in seconds. The good news is that the same kind of scanner is free and points the other way: you can run it against your own repositories and catch a leaked secret before anyone else does. Learning to scan, read the findings, and respond correctly is a skill every developer and defender is expected to have.
What you'll learn
- secret scanning
- gitleaks
- reading scanner findings
- why git history persists
- rotating leaked credentials
- pre-commit prevention
Steps in this lab
- Why a leaked secret is a breach waiting to happen
- Install gitleaks
- Point it at a repo you own
- Read a finding: file, rule, and commit
- Why deleting the line does not fix it
- Prevent it: keep secrets out with .gitignore and environment variables
- Prevent it automatically: a pre-commit hook and secret scanning
- What you built the instinct for