← VCE Cyber Security

Improper credential management

When passwords, keys or tokens are stored, shared or reused insecurely, letting attackers steal them and gain unauthorised access.

Part of: VCE Applied Computing - U2O2 - Cyber Security — Module 34, 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 61, VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 35

Understanding Improper credential management in VCE Cyber Security

What it does: This code applies a hash function to protect the stored password. This code retrieves the API key securely instead of embedding it in source. Plaintext storage lets anyone who reads the code or file see the credential directly. A properly hashed value can't easily be reversed back into the original credential. One leaked password can then unlock every other system that reuses it. Hardcoded keys stay exposed wherever the code is stored, shared, or version controlled. The token may already be captured in logs or terminal history before the line is removed. Sharing credentials over chat can expose them to anyone with access to the conversation.

Common mistakes: Line 1 sets the password to a weak, easily guessed value like '12345' before it's even hashed. Saving the raw password to a file exposes it in plaintext instead of storing only the hash.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Improper credential management to a class →

This module's key terms are also in a printable crossword (Modules 31–40) and word search (Modules 21–40).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Storing a password in plaintext in your code is secure practice.
TrueFalse
Matches
password = username
↓
The mistake: reusing the username as the password value
Applying
Meanings
Term
Improper credential management
Meaning
When passwords, keys or tokens are stored, shared or reused insecurely, letting attackers steal them and gain unauthorised access.
Practice
username = "admin"
Testing
Gaps
= "Summer2023"
Check Answer
Spots
1password = "12345"
2hash_pw = hash(password)

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Silverback Gorilla' badge — Savannah Master, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Storing a password in plaintext in your code is secure practice.
A. True
B. False ✓
Plaintext storage lets anyone who reads the code or file see the credential directly.
2. Which is safer to store: a hashed password or the raw password?
A. Hashed password ✓
B. Raw password
A properly hashed value can't easily be reversed back into the original credential.
3. Reusing the same password across multiple systems is good practice.
A. True
B. False ✓
One leaked password can then unlock every other system that reuses it.
4. Which is riskier: hardcoding an API key in source code, or loading it from a secure vault?
A. Hardcoding in source code ✓
B. Loading from a secure vault
Hardcoded keys stay exposed wherever the code is stored, shared, or version controlled.
5. Printing a secret token to the console while debugging is fine as long as you delete the line later.
A. False ✓
B. True
The token may already be captured in logs or terminal history before the line is removed.

Match the Pairs

password = "admin123" → Storing a plaintext password directly in code
log(password) → Writing a raw credential into logs, exposing it
Hashing turns a password into a value that can't easily be reversed → hashed = hash(password)
Loading a secret from a secure vault instead of hardcoding it → api_key = load_secret()
password = username → The mistake: reusing the username as the password value
admin_pw = "admin" → The mistake: leaving a default hardcoded admin credential in place

Key Term

Improper credential management
When passwords, keys or tokens are stored, shared or reused insecurely, letting attackers steal them and gain unauthorised access.

Fill in the Blanks

1. password = "Summer2023"
Hint: Type the name of the variable used to store the password value.
2. api_key = "12345-ABCDE"
Hint: Type the name of the variable used to store the API key.
3. secret_key = "mysecret"
Hint: Type the name of the variable used to store the secret key.
4. token = "eyJhbGciOiJIUzI1NiJ9"
Hint: Type the name of the variable used to store the token.
5. username = "admin" password = username
Hint: Type the name of the variable that should hold a separate, unique password value.

Spot the Error

Question 1
A password = "12345"
B hash_pw = hash(password)
C store(hash_pw)
Line A — Line 1 sets the password to a weak, easily guessed value like '12345' before it's even hashed.
Question 2
A hash_pw = hash(password)
B save_to_file(password)
C db.save(hash_pw)
Line B — Saving the raw password to a file exposes it in plaintext instead of storing only the hash.
Question 3
A token = generate_token()
B session.token = token
C print(token)
Line C — Printing the token can leak it into console output or logs, exposing a live credential.
Question 4
A api_key = load_secret()
B headers = {"key": api_key}
C request(url, headers)
D api_key = "sk_live_9231"
Line D — Hardcoding a live API key directly in code risks exposure if the source is ever shared or leaked.
Question 5
A password = get_secure_input()
B hashed = hash(password)
C salt = generate_salt()
D store(hashed, salt)
E log(password)
Line E — Logging the raw password writes a live credential into logs where it can be read later.

Student with a class code? Join your class →