Independent & educational platform Not a government body. No link or affiliation with any government organisation. Made for learning only. Test only systems you own or are authorised to test. Become a Partner or Sponsor → Full disclaimer
Secure codingeasy100 pts0 solves

Secrets in History

A developer noticed a hard-coded API key and removed it in the latest commit — "problem solved". You received the repository as a tarball.

Learning objectives

Learn that deleting a secret from the current code does not remove it from version-control history; practise git log -p.

Instructions

Extract inventory-app.tar.gz and inspect the git history. The flag is the API key that used to be committed.

Prerequisites: Basic git commands.
Flag format: cspk{...}
Files: inventory-app.tar.gz (13.3 KB) (download after registering)
Useful tools: Gitleaks TruffleHog
Register to play

References

Write-up

The full write-up and learning takeaways unlock after you solve this challenge — spoilers stay hidden until then.