OWASP WrongSecrets is an open source security education project that aims to increase the awareness of developers and security practitioners of the risks of secret management by simulating various real-world cases of "mistakenly storing and managing sensitive information." The project focuses on interactive challenges (currently 55 in total), each of which demonstrates a common but dangerous way to store secrets, such as hard-coded passwords, misconfigured cloud keys, and leaked environmental variables. Users can run and experience these challenges in a variety of environments such as local, Docker, Kubernetes, Heroku, and cloud platforms, and learn how to discover and avoid security risks through practical operations. In addition, WrongSecrets also supports CTF competition mode, which is suitable for team training and safety drills. By participating in WrongSecrets, developers can not only improve their own security awareness, but also master industry best practices to better protect sensitive data of enterprises and users in practical work.
