Exposed Secrets
Critical · Configuration · CWE-798
Description
API keys/passwords in repos, images, or logs.
Root cause
Secrets in git history or env vars in client.
Impact
Full account compromise.
Detection
Secret scanning (Gitleaks/TruffleHog).
Mitigation
Vault/secret manager; pre-commit hooks.
Secure coding
Rotate on exposure; never commit secrets.
Safe lab example
DevSecOps pipeline labs
Practise related skills in Labs or deepen on Academy library.