Secure › Module 9 › Lesson 4
Secrets Lab
Plant synthetic secret in $REPO branch, detect with gitleaks, rotate and clean — lab key only.
Visual · t17_secrets_lab
Lab: gitleaks detect + rotation drill on $REPO. Original Cyberlium.
Opening
Bury a fake key, find it, rotate it — all in a repo you own and a credential you control.
On disposable branch in $REPO: (1) add synthetic secret string matching gitleaks rule (fake ghp_ or test AKIA from provider fake docs — never real prod keys); (2) run gitleaks detect and capture redacted output; (3) remove secret, run again clean; (4) write rotation runbook steps as if key were real. chmod 600 notes. Optional: add gitleaks CI job. No planting secrets in public example repos, no scanning third-party orgs.
1. Synthetic leak
Use obviously fake test pattern — provider test credential or labeled FAKE key.
Branch never merged to main with secret present.
Command guide
Try these commands — Synthetic leak
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Pre-commit hooks — https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html Gitleaks — https://github.com/gitleaks/gitleaks
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
brew install gitleaks # or go install
macOS:
Command — copy this
brew install gitleaks
Windows:
Command — copy this
choco install gitleaks
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t17-lab.env" 2>/dev/null || MY_REPO=$HOME/cyberlium-lab/t17-toy
rm -f "$HOME/cyberlium-lab/t17-demo/leak_demo.env" 2>/dev/null || true
gitleaks detect --source "${MY_REPO:-$HOME/cyberlium-lab/t17-toy}" --no-git || true
grep -rE 'password=|api_key=' "${MY_REPO:-$HOME/cyberlium-lab/t17-toy}" 2>/dev/null | head -5 || echo 'Secrets lab clean'Primary tools to practice this lesson: gitleaks, grep. Reference sites: Pre-commit hooks (https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html); Gitleaks (https://github.com/gitleaks/gitleaks). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Detect and clean
gitleaks output redacted in notes. Second scan shows clean.
Document rotation steps you would take for real key.
3. Teardown
Delete branch. Confirm main has no secrets. Enable protect hook.
chmod 600 lab notes — no live values.
4. What you ship: secrets lab evidence
Redacted gitleaks hit + clean scan + rotation runbook — chmod 600.
5. What you record before the next lesson
Secrets lab notes path.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Plant real AWS key in class shared repo to 'test gitleaks.'
Right
Secrets lab on $REPO with synthetic key. Next: quiz.
Mission: secrets lab
1) Synthetic secret on branch; gitleaks detect. 2) Remove and re-scan clean. 3) Rotation runbook; secure notes.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Fake key formats for drills?”
Knowledge Check
APPLY: Secrets lab uses:
Multiple choice
Knowledge Check
APPLY: True or False: Planting real keys in shared repo is lab.
True or False
Knowledge Check
APPLY: After clean scan:
Multiple choice