Skip to content

Secrets hiding in plain sight, and in image layers

Duration
2m 51s
Steps
7
Agents
Recon, Triage, Fix

Sample runs against public, intentionally vulnerable apps. The vulnerabilities are real; timings and traces are illustrative.

Prompt
Find every live secret in this repo, its history and its container image. Don’t page me for test values.
  1. 00:02Recon

    Scanned code, git history and the image

    $ enforster secrets ./wrongsecrets --history --image wrongsecrets:latest
    › Output
    1,904 commits · 14 image layers · 27 candidate secrets
  2. 00:38TriageVerified

    Verified: secret hardcoded in application source

    Found in a Java constant and served unchanged by the app.

  3. 01:04TriageVerified

    Verified: secret baked into a Dockerfile ENV

    Present in an image layer even though later layers never print it.

  4. 01:37TriageVerified

    Verified: secret recoverable from git history

    Removed in a later commit but still in history.

  5. 02:00TriageDismissed

    Dismissed 19 candidates

    Placeholder values, example keys in docs and test fixtures.

  6. 02:38Fix

    Drafted a rotation and purge plan

    Rotate, move to a secrets manager, rebuild the image without the ENV layer, and purge history.

  7. 02:51Triage

    Run complete: 3 verified, 19 dismissed

What it proved

  • High

    Secret hardcoded in source

    Java constant

    Proof
    Value matches the secret the app accepts
    Fix
    Load from a secrets manager at runtime
  • High

    Secret stored in a container image layer

    Dockerfile ENV

    Proof
    Recovered with docker history
    Fix
    Pass at runtime; never bake into layers
  • Medium

    Secret still present in git history

    Earlier commit

    Proof
    git log -p reveals the value
    Fix
    Rotate, then purge history
Next runInfrastructure code that ships its own keys

A 30-minute demo with zero slides. Bring a repo, a domain or a cloud account and we’ll show you what’s actually exploitable, live.

Book a demo