Never Plaintext

Secrets, tokens, and passwords never stored raw — vault habits in YOUR repo only.

Never Plaintext• Audio Walkthrough

00:00/03:18

Visual · never_plaintext

No plaintext secrets literacy. $MY_REPO only. Original Cyberlium.

If it is a password or API key, plaintext on disk is a incident waiting — fix YOUR config, not stranger databases.

Never plaintext means: no password columns, no API keys in git history, no session secrets in client JS, no.env committed to public repo. Use environment variables, secret managers, and hashed passwords in $MY_REPO. Cyberlium teaches grep for secrets and rotate lab keys — not downloading stranger.env leaks or phishing OAuth tokens from classmates. You will NOT build phishing OAuth kits or harvest tokens from live shops. Next: Auth Storage Lab.

1. Passwords, keys, tokens — three never-plaintext classes

Passwords: hash with bcrypt/Argon2 only. API keys: env var or vault, never commit. Session tokens: httpOnly secure cookies server-side, not localStorage for sensitive sessions in production patterns.

Grep $MY_REPO for password=, api_key=, BEGIN PRIVATE KEY — redact and rotate lab fakes.

Command guide

Try these commands — Passwords, keys, tokens — three never-plaintext classes

═══ LINUX / BASH (Network & Reconnaissance Audit) ═══

Scan target host for open ports and service version signatures

Command — copy this

nmap -sS -sV -p 80,443,8080 -Pn ${LAB_HOST:-127.0.0.1}

DNS and WHOIS reconnaissance on authorized domain

Command — copy this

dig +short A target.local
dig +short MX target.local
whois target.local 2>/dev/null | grep -iE "(Registrar|Creation Date|Name Server)" | head -6

Inspect HTTP headers for technology stack fingerprinting

Command — copy this

curl -s -I "http://${LAB_HOST:-127.0.0.1}:8080" | grep -iE "(Server|X-Powered-By|Set-Cookie|Content-Security-Policy)"

Primary tools to practice this lesson: grep, python3. Reference sites: CWE-256 plaintext (https://cwe.mitre.org/data/definitions/256.html); Password storage (https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Git history remembers

Deleting a secret in latest commit is not enough — history may retain it. Lab: use git-secrets literacy or manual audit; rotate any test key that touched a branch.

Publishing classmate leaked.env in chat is harm — not secure-coding practice.

3. No OAuth phish kits

OAuth literacy comes in Module 6 — not fake login pages aimed at strangers or classmates. This lesson is storage hygiene on $MY_REPO only.

Ship: grep audit note + one rotation action. Next: Auth Storage Lab.

4. What you ship: plaintext audit for $MY_REPO

Grep results redacted. Lab secrets in env not git. No OAuth phish. chmod 600.

5. What you record before the next lesson

Date. Plaintext audit summary. Rotation if needed. File t17-m05-l03-never-plaintext.txt chmod 600.

6. Wrong vs right: stranger apps vs YOUR repo

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Commit real API key to public $MY_REPO. Share classmate.env in Discord. Build OAuth phish page.
Right: Audit and redact plaintext secrets in $MY_REPO. Next: Auth Storage Lab.

Hands-on Exercise