Hard-coded API keys and secrets

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A developer writes API_KEY = "sk_live_83hd92" directly in app.py. Is this a hard-coded secret?

A Yes, the key is written directly in the source code

B No, it is safe because it is inside a variable

2. A student commits config.py containing a database password to a repository. Who can steal the password?

A Anyone who can read the repository

B Only the developer who wrote the file

3. A developer pushes code with a hard-coded API key to a public repository. What is the risk?

A The key is hidden because the code is compiled later

B Strangers can find and use the key, for example by scanning public code

4. You notice a key was committed by mistake and you delete the file in your next commit. Is the key now safe?

A No, the key still exists in the commit history

B Yes, deleting the file removes the key everywhere

5. A key was exposed in a repository's history. What should the team do first?

A Delete the file and keep using the same key

B Revoke the key and issue a new one

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1API_KEY = "sk_live_51Hx9Zq"		AThe token is hard-coded in the source file and relying on remembering to remove it later is unsafe. Once committed or pushed, it stays in the history and can be stolen.
2git push origin main		BPublishes commits to a remote repository, so any key committed earlier is now visible to everyone with access to that repository
3Deleting a file that contains a key in a later commit is not enough, because the old commit history still holds the key		CA hard-coded secret: a live API key typed straight into the source code, where anyone who can read the code can copy it
4A password committed to a repository can be stolen by anyone who can read it, including the public if the repository is public		Dgit rm config.py && git commit -m "remove key"
5token = "ghp_a8Kd92Lx" # remove before pushing later		EDeleting the file in a new commit does not remove the keys from earlier commits, so a leaked key can still be found in the history and must be revoked.
6git rm secrets.txt git commit -m "deleted keys"		Fdb_password = "Summer2024!"

Definitions

hard-coded secret

Fill in the Blanks

Complete each line of code by filling in the missing parts.

const ______ = "sk_live_abc123"; fetch(url + "?key=" + apiKey);

git add config.py git ______ -m "Add API key"

# Public repo: key is now visible git ____ origin main

git rm config.py git commit -m "Remove key" git ___ -p

echo "config.py" >> __________

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A import os

B key = "sk_live_51Hx8d2"

C url = "https://api.site.com"

D print("Calling API")

Question 2

A Dev pushes app.py with key

B Nobody reads public code

C Attacker copies the key

D Attacker runs up your bill

Question 3

A const pw = "Pa55word!";

B const user = "app_user";

C connect(user, pw);

Question 4

A import os

B # TODO remove key sk_live_8f2a

C key = os.environ["API_KEY"]

D print("Key loaded")

Question 5

A # .env

B *.pem

C secrets.json

Answer Key

Hard-coded API keys and secrets

Section A: Quick Questions

A — Yes, the key is written directly in the source code

A — Anyone who can read the repository

B — Strangers can find and use the key, for example by scanning public code

A — No, the key still exists in the commit history

B — Revoke the key and issue a new one

Section B: Match the Pairs

API_KEY = "sk_live_51Hx9Zq" → A hard-coded secret: a live API key typed straight into the source code, where anyone who can read the code can copy it

git push origin main → Publishes commits to a remote repository, so any key committed earlier is now visible to everyone with access to that repository

Deleting a file that contains a key in a later commit is not enough, because the old commit history still holds the key → git rm config.py && git commit -m "remove key"

A password committed to a repository can be stolen by anyone who can read it, including the public if the repository is public → db_password = "Summer2024!"

token = "ghp_a8Kd92Lx" # remove before pushing later → The token is hard-coded in the source file and relying on remembering to remove it later is unsafe. Once committed or pushed, it stays in the history and can be stolen.

git rm secrets.txt git commit -m "deleted keys" → Deleting the file in a new commit does not remove the keys from earlier commits, so a leaked key can still be found in the history and must be revoked.

Section C: Definitions

hard-coded secret — A key, password or token written directly into source code. Anyone who can read the code or its repository can steal it, and deleting the file later does not remove it from the history.

Section D: Fill in the Blanks

const apiKey = "sk_live_abc123";
fetch(url + "?key=" + apiKey);

git add config.py
git commit -m "Add API key"

# Public repo: key is now visible
git push origin main

git rm config.py
git commit -m "Remove key"
git log -p

echo "config.py" >> .gitignore

Section E: Spot the Error

B — The API key is typed straight into the source code, so anyone who can read the code or its repository can steal it. It should be read from an environment variable: key = os.environ["API_KEY"].

B — Automated bots constantly scan public repositories for leaked keys, often within minutes of a push. The line should say that bots scan public code for keys.

A — The database password is hard-coded in the source file, so anyone who can read the code can see it. It should be loaded from the environment: const pw = process.env.DB_PW;

B — A comment is still part of the source code. Anyone reading the file or the repository can see the key written in it. The comment should not contain the secret, for example: # Key is read from env var.

A — In a .gitignore file, a leading # turns the line into a comment, so .env is no longer ignored. The secrets file could then be committed to the repository. The line should be .env.