help wanted
Repository metrics
- Stars
- (1,457 stars)
- PR merge metrics
- (Avg merge 4d 1h) (29 merged PRs in 30d)
Description
This ticket is for creating/listing possible ideas. If an Idea is picked up by a developer, then it gets its own tickets.
- #44
- #43
- Google support (https://github.com/commjoen/wrongsecrets/issues/40, https://github.com/commjoen/wrongsecrets/issues/39),
- #93
- Alibaba cloud support (will not do this, maybe have a write up later?)
- #299
- Heroku support
- #144
- Secret in logs (= challenge 8)
- #187
- #188
- #189
- #199
- #200
- #201
- #148
- Hardcoded in testcode (https://github.com/commjoen/wrongsecrets/issues/37#issuecomment-1011482070)
- #296
- #810
- #815
- #297
- #811
- #812
- have a too long living OIDC token which can be used to extract and apply (wont'do)
- Jenkins or other github secondary ci/cd secret (won't do, as it requiers another container next to it & needs maintenance. Our current ci/cd action shows the issue already.
- #345
- Simple one that is a mix of 1 & 13: docker container is run with password as parameter, but the whole command is placed in a .sh file and stored in the git repo (aka: use .gitignore to block local helper scripts)
- #344
- SOPS/sealed secrets misconfig : a bogus sealed secret with misconfigured retrieval setup? (pending)
- #615
- #614
- #613
- #377
- #616
- #809
- #813
- Based on @robvanderveer his suggestion: https://github.com/OWASP/wrongsecrets/issues/616
- Have passwordless challenges based on impersonation such as https://github.com/OWASP/wrongsecrets/blob/master/src/main/resources/explanations/challenge11_hint-azure.adoc - agreed to not create a new challenge, but extend GCP/AWS with a similar solution for cahllenge 11.
- #814
- Bad RSA private key redaction; https://www.hezmatt.org/~mpalmer/blog/2020/05/17/private-key-redaction-ur-doin-it-rong.html (tip from @nbaars )
- A kotlin binary