Possible new ideas for challenges

This ticket is for creating/listing possible ideas. If an Idea is picked up by a developer, then it gets its own tickets.

• #44
• #43
• Google support (https://github.com/commjoen/wrongsecrets/issues/40, https://github.com/commjoen/wrongsecrets/issues/39),
• #93
• Alibaba cloud support (will not do this, maybe have a write up later?)
• #299
• Heroku support
• #144
• Secret in logs (= challenge 8)
• #187
• #188
• #189
• #199
• #200
• #201
• #148
• Hardcoded in testcode (https://github.com/commjoen/wrongsecrets/issues/37#issuecomment-1011482070)
• #296
• #810
• #815
• #297
• #811
• #812
• have a too long living OIDC token which can be used to extract and apply (wont'do)
• Jenkins or other github secondary ci/cd secret (won't do, as it requiers another container next to it & needs maintenance. Our current ci/cd action shows the issue already.
• #345
• Simple one that is a mix of 1 & 13: docker container is run with password as parameter, but the whole command is placed in a .sh file and stored in the git repo (aka: use .gitignore to block local helper scripts)
• #344
• SOPS/sealed secrets misconfig : a bogus sealed secret with misconfigured retrieval setup? (pending)
• #615
• #614
• #613
• #377
• #616
• #809
• #813
• Based on @robvanderveer his suggestion: https://github.com/OWASP/wrongsecrets/issues/616
• Have passwordless challenges based on impersonation such as https://github.com/OWASP/wrongsecrets/blob/master/src/main/resources/explanations/challenge11_hint-azure.adoc - agreed to not create a new challenge, but extend GCP/AWS with a similar solution for cahllenge 11.
• #814
• Bad RSA private key redaction; https://www.hezmatt.org/~mpalmer/blog/2020/05/17/private-key-redaction-ur-doin-it-rong.html (tip from @nbaars )
• A kotlin binary