Secure › Module 9 › Lesson 1
Secret Shapes
API keys, tokens, PEM blocks — recognize shapes; keep them out of YOUR $REPO.
Visual · t17_secret_shapes
Secrets have recognizable patterns — and belong in vaults, not git. Original Cyberlium.
Opening
AWS AKIA… in a commit is not a learning moment for the internet — it is a rotation incident.
Hardcoded secrets appear as high-entropy strings, provider prefixes (AKIA, ghp_, sk_live_), PEM headers (BEGIN PRIVATE KEY), JWT eyJ segments, and connection strings with passwords. Learn shapes to catch mistakes in YOUR code before push — never go hunting for live keys in stranger repos, paste sites, or breach dumps to 'practice.' Use environment variables, secret managers, and.gitignore for local.env on $REPO. If you accidentally commit a test key, rotate immediately — do not assume private repo means safe.
1. Common shapes
Cloud access keys, OAuth client secrets, database URLs, private keys, webhook HMAC secrets.
Provider docs list prefix patterns — use for review checklists.
Command guide
Try these commands — Common shapes
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Secrets management — https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html CWE-798 — https://cwe.mitre.org/data/definitions/798.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
python3 -c "print('Ban from git:', ['AKIA','ghp_','sk-live-','BEGIN PRIVATE KEY'])"
grep -rE 'AKIA|ghp_|BEGIN PRIVATE KEY' "$HOME/cyberlium-lab/t17-toy" 2>/dev/null | head -5 || echo 'No secret shapes in MY_REPO'Primary tools to practice this lesson: grep, python3. Reference sites: Secrets management (https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html); CWE-798 (https://cwe.mitre.org/data/definitions/798.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Safe storage
Env vars at runtime; vault or CI secret store for pipelines; never in source literals.
.env.example with placeholders only — real.env local and gitignored.
3. Boundary
Practice recognition on synthetic samples in $REPO lab exercises.
No scraping GitHub for real keys — report via proper channels if you stumble accidentally.
4. What you ship: secret shape cheat sheet
Five shapes/prefixes + env-var rule + NEVER hunt live stranger keys.
5. What you record before the next lesson
Secret shapes cheat sheet path.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Collect live API keys from public GitHub for a 'wordlist.'
Right
Name secret shapes. Next: gitleaks literacy.
Mission: secret shape sheet
1) List five secret shapes or prefixes. 2) Write.env vs.env.example rule. 3) Write NEVER scrape live keys.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Test key vs prod key naming?”
Knowledge Check
APPLY: ghp_ prefix often indicates:
Multiple choice
Knowledge Check
APPLY: True or False: Hunting live keys in stranger repos is lab.
True or False
Knowledge Check
APPLY: Secrets belong in:
Multiple choice