Secrets, Ethics & Scope

A string like api_key = "sk_live_example" inside a .py file will be copied, screenshotted, committed, and scraped by bots that watch public git. That is not a style issue. It is a secret-exposure incident. The fix is mechanical: the process environment holds the value; the source holds the name. import os; api_key = os.environ.get("SOC_API_KEY"); if not api_key: raise SystemExit("Missing SOC_API_KEY"). The script fails closed when the key is absent instead of falling back to a default that someone left in the repo. For local labs, a file $HOME/cyberlium-lab/.env.soc with chmod 600 and a line SOC_API_KEY=... is acceptable if that path is in .gitignore. You still do not put a real billed cloud key in the notes you might screenshot for class. Use a clearly fake value like CHANGE_ME_NOT_A_REAL_KEY when you are only proving the read path.

Least privilege: a token that can only read a test mailbox is better than a god token that can delete production. Rotate when exposed: if it hit git, revoke it at the provider, do not “delete the commit locally” and hope clones died. git history keeps secrets. Assume leak, rotate, then add .gitignore. Do not scan other people’s repositories for keys without a program that invites that (and even then, disclose, do not use the key). This course does not teach secret-scanning other orgs. Your job is your tree: grep your own repo for key-shaped literals before you push. Never commit API keys. chmod 600 any file that holds one. Windows: restrict the ACL in your profile if you lack chmod.

Rules of engagement (RoE) are a written statement of what you may touch, when, and with which tools. In a pentest, that is a signed PDF. In this course, the RoE is the lesson text: localhost, lab VMs you created, files in $HOME/cyberlium-lab you created, accounts you own. The internet, a neighbor’s router, a classmate’s SSH, a work VPN, a random hostname from a tutorial, and “the cloud” without a project you own are outside. Module 2 already forced HOST = "127.0.0.1". That was not a training-wheels insult. Connecting to a foreign address with a scanner is unauthorized access in many jurisdictions even if you “only connected.” requests.get to a site you do not have in writing, at volume, is the same family of mistake as a scan.

A ticket, an email from the owner, or a published bounty program with a scope section beats a Slack joke. Dates matter: permission for last quarter is not permission tonight. Host lists matter: *.lab.example.com does not include the company’s identity provider. If it is not written, you do not scan. If you own the host, you can still wreck it — that is why localhost and snapshots exist. Gray-zone scripts: “anonymous” mass scanners, auto-exploit frameworks pointed at the WAN, password sprays “just to see if default creds work on the office Wi-Fi.” Those are not labs. They are how people get expelled, fired, or charged. Keep offensive learning inside a VM network that does not route to the office or the ISP’s other customers.

Courts, employers, and schools look at what you pointed the tool at, not at the comment in your source that says learning. A port connect is a port connect. A login POST is a login POST. A copy of production logs is a copy of production logs. Python is not a magic language that converts those into homework. Curiosity, boredom, “but the tutorial used scanme.example.com,” and “I was going to tell them if it worked” are not controls. The control is scope you can show: localhost, your VM, your file, a letter. If you cannot show it, do not send the packet. If you already sent it, stop, do not double down with a bigger scan, and do not invent a cover story. This lesson will not give you a legal script. It will give you a habit: fail closed on missing keys, fail closed on missing permission.

The script below reads SOC_API_KEY from the environment. You export a clearly fake value, run it, then write ethics notes. You do not put a production token anywhere in cyberlium-lab. You add a .gitignore stanza so .env.soc cannot be added by accident. chmod 600 the env file and the notes.

mkdir -p "$HOME/cyberlium-lab"
cd "$HOME/cyberlium-lab"

cat > read_secret.py << 'PY'
import os
import sys

api_key = os.environ.get("SOC_API_KEY")
if not api_key:
    sys.exit("Missing SOC_API_KEY — fail closed, no hardcoded default")
if api_key.startswith("sk_live_") or "BEGIN" in api_key:
    sys.exit("Refusing a value that looks like a live secret in this teaching script")
print("SOC_API_KEY loaded from environment, length:", len(api_key))
print("ok: source file contains no key literal")
PY

export SOC_API_KEY="CHANGE_ME_NOT_A_REAL_KEY"
python3 read_secret.py

printf '%s
' 'SOC_API_KEY=CHANGE_ME_NOT_A_REAL_KEY' > .env.soc
chmod 600 .env.soc read_secret.py

touch .gitignore
grep -q '\.env' .gitignore 2>/dev/null || printf '%s
' '.env' '.env.*' '*.pem' >> .gitignore

NOTES="$HOME/cyberlium-lab/ethics-scope.txt"
{
  echo "=== SECRETS, ETHICS, SCOPE ==="
  echo "keys: os.environ.get / chmod 600 file — NEVER literals in .py"
  echo "gitignore: .env .env.* *.pem"
  echo "roe: localhost, lab VMs I own, files I created in cyberlium-lab"
  echo "not_in_scope: internet scans, classmate SSH, work VPN, prod logs"
  echo "phrase_that_fails: I was just practicing"
  echo "no_hydra: generated passwords are for MY manager, not live logins"
} > "$NOTES"
chmod 600 "$NOTES"

You now treat a hardcoded key as an incident, permission as a written control, and practice-as-defense as a sentence that fails. Environment, chmod 600, .gitignore, localhost. Next — Lab: File Integrity Hash Check — hashlib SHA-256 of YOUR files in cyberlium-lab, before/after an edit, integrity rather than cracking or rainbow tables.