Improper credential management

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Storing a password in plaintext in your code is secure practice.

A True

B False

2. Which is safer to store: a hashed password or the raw password?

A Hashed password

B Raw password

3. Reusing the same password across multiple systems is good practice.

A True

B False

4. Which is riskier: hardcoding an API key in source code, or loading it from a secure vault?

A Hardcoding in source code

B Loading from a secure vault

5. Printing a secret token to the console while debugging is fine as long as you delete the line later.

A False

B True

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1password = "admin123"		Ahashed = hash(password)
2log(password)		BThe mistake: leaving a default hardcoded admin credential in place
3Hashing turns a password into a value that can't easily be reversed		CWriting a raw credential into logs, exposing it
4Loading a secret from a secure vault instead of hardcoding it		DStoring a plaintext password directly in code
5password = username		EThe mistake: reusing the username as the password value
6admin_pw = "admin"		Fapi_key = load_secret()

Definitions

Improper credential management

Fill in the Blanks

Complete each line of code by filling in the missing parts.

________ = "Summer2023"

_______ = "12345-ABCDE"

__________ = "mysecret"

_____ = "eyJhbGciOiJIUzI1NiJ9"

username = "admin" ________ = username

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A password = "12345"

B hash_pw = hash(password)

C store(hash_pw)

Question 2

A hash_pw = hash(password)

B save_to_file(password)

C db.save(hash_pw)

Question 3

A token = generate_token()

B session.token = token

C print(token)

Question 4

A api_key = load_secret()

B headers = {"key": api_key}

C request(url, headers)

D api_key = "sk_live_9231"

Question 5

A password = get_secure_input()

B hashed = hash(password)

C salt = generate_salt()

D store(hashed, salt)

E log(password)

Answer Key

Improper credential management

Section A: Quick Questions

B — False

A — Hashed password

B — False

A — Hardcoding in source code

A — False

Section B: Match the Pairs

password = "admin123" → Storing a plaintext password directly in code

log(password) → Writing a raw credential into logs, exposing it

Hashing turns a password into a value that can't easily be reversed → hashed = hash(password)

Loading a secret from a secure vault instead of hardcoding it → api_key = load_secret()

password = username → The mistake: reusing the username as the password value

admin_pw = "admin" → The mistake: leaving a default hardcoded admin credential in place

Section C: Definitions

Improper credential management — When passwords, keys or tokens are stored, shared or reused insecurely, letting attackers steal them and gain unauthorised access.

Section D: Fill in the Blanks

password = "Summer2023"

api_key = "12345-ABCDE"

secret_key = "mysecret"

token = "eyJhbGciOiJIUzI1NiJ9"

username = "admin"
password = username

Section E: Spot the Error

A — Line 1 sets the password to a weak, easily guessed value like '12345' before it's even hashed.

B — Saving the raw password to a file exposes it in plaintext instead of storing only the hash.

C — Printing the token can leak it into console output or logs, exposing a live credential.

D — Hardcoding a live API key directly in code risks exposure if the source is ever shared or leaked.

E — Logging the raw password writes a live credential into logs where it can be read later.