Managing secrets outside source code

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Where should an API key for a payment service be stored?

A In an environment variable or secrets vault

B In a constant at the top of the source code file

2. A developer commits a database password to a shared repository. What is the main problem?

A Anyone with repository access, now or later, can read it in the commit history

B The password will stop working once it is committed

3. Which statement about rotating keys is correct?

A Replacing keys regularly limits how long a stolen key can be used

B Rotating keys makes them impossible to steal

4. What does a secrets scanning tool do on a commit?

A Encrypts every file in the repository automatically

B Checks the changes for passwords, keys and tokens before they are pushed or merged

5. A key was accidentally pushed to a public repository. What is the best response?

A Delete the file in a new commit and carry on

B Revoke and rotate the key, then investigate any misuse

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1API_KEY = os.environ["API_KEY"]		Avault.rotate("payment-api-key")
2git secrets --scan		BReads the API key from an environment variable at run time, so the secret is not written in the source code
3Secrets should be stored in a .env file that is excluded from version control, so they never reach the repository		CScans commits and files for passwords or keys before they are pushed, so leaked secrets are caught early
4Keys should be rotated regularly, so a leaked or stolen key stops working once it is replaced		DThe API key is hard-coded in the source code, so anyone with repository access can see and misuse it. It should be loaded from an environment variable or a secrets vault.
5API_KEY = "sk_live_51Hx9a7"		E.env
6git add .env git commit -m "add config"		FThe .env file containing secrets is committed to the repository. It should be added to .gitignore, and any leaked keys should be rotated.

Definitions

secrets management

Fill in the Blanks

Complete each line of code by filling in the missing parts.

key = os.______("API_KEY")

if ___ api_key: raise ValueError("Key missing")

echo ____ >> .gitignore

vault.______("db_password")

if len(leaks) _ 0: block_commit()

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A import os

B key = "sk_live_9f8a7b6c"

C headers = {"key": key}

Question 2

A node_modules/

B *.log

C # .env

Question 3

A created = key_info["created"]

B age = (today - created).days

C if age < 90:

D rotate_key()

Question 4

A secrets=$(scan_staged_files)

B if [ -n "$secrets" ]; then

C echo "Secret found!"

D exit 0

E fi

Question 5

A key = os.environ("API_KEY")

B log("Calling API")

C r = call_api(key)

Answer Key

Managing secrets outside source code

Section A: Quick Questions

A — In an environment variable or secrets vault

A — Anyone with repository access, now or later, can read it in the commit history

A — Replacing keys regularly limits how long a stolen key can be used

B — Checks the changes for passwords, keys and tokens before they are pushed or merged

B — Revoke and rotate the key, then investigate any misuse

Section B: Match the Pairs

API_KEY = os.environ["API_KEY"] → Reads the API key from an environment variable at run time, so the secret is not written in the source code

git secrets --scan → Scans commits and files for passwords or keys before they are pushed, so leaked secrets are caught early

Secrets should be stored in a .env file that is excluded from version control, so they never reach the repository → .env

Keys should be rotated regularly, so a leaked or stolen key stops working once it is replaced → vault.rotate("payment-api-key")

API_KEY = "sk_live_51Hx9a7" → The API key is hard-coded in the source code, so anyone with repository access can see and misuse it. It should be loaded from an environment variable or a secrets vault.

git add .env git commit -m "add config" → The .env file containing secrets is committed to the repository. It should be added to .gitignore, and any leaked keys should be rotated.

Section C: Definitions

secrets management — Keeping passwords, API keys and tokens in a protected vault or environment variable, not in source code, and rotating keys and scanning commits for leaks.

Section D: Fill in the Blanks

key = os.getenv("API_KEY")

if not api_key:
    raise ValueError("Key missing")

echo .env >> .gitignore

vault.rotate("db_password")

if len(leaks) > 0:
    block_commit()

Section E: Spot the Error

B — The API key is hard-coded in the source, so anyone who can read the code or repository can steal it. It should be read from an environment variable: key = os.environ["API_KEY"].

C — Putting # in front turns the rule into a comment, so Git no longer ignores .env and the secrets in it can be committed. The line should be .env.

C — The comparison is the wrong way round. The key would be rotated while it is still new and old keys would never be rotated. Keys older than 90 days should be rotated, so it should be if age > 90:.

D — Exiting with 0 tells Git the hook succeeded, so the commit goes ahead even though a secret was found. A pre-commit hook must exit with a non-zero code such as exit 1 to block the commit.

A — os.environ is a dictionary-like object, not a function, so calling it with brackets causes an error. It should be looked up with square brackets: os.environ["API_KEY"].