Git & Repository Security Training
Replay a leaked key from a real repo’s history, then rotate it, scrub it and lock the branch.
8 exercises Free, no sign-up
Git & Repository Security
8 exercises- Secrets in Git History Recover a live API key from the commit that removed it.
- CWE-540
- ATT&CKT1552.001
- CIS 3
- NIST CSFPR.DS
- Exposed .git Directory Rebuild an entire codebase from one public URL.
- CWE-527
- ATT&CKT1213.003
- CIS 16
- NIST CSFPR.PS
- Committed Secret Files Clone a public repo and read its committed .env.
- CWE-540
- ATT&CKT1552.001
- CIS 3
- NIST CSFPR.DS
- Commit Author Spoofing Land a backdoor wearing a maintainer’s name.
- CWE-345
- ATT&CKT1036
- CIS 16
- NIST CSFPR.PS
- Branch Protection Bypass Force-push over main and skip review and CI.
- CWE-285
- ATT&CKT1195.002
- CIS 16
- NIST CSFPR.PS
- Leaked Access Tokens Clone private repos with a token from a public gist.
- CWE-522
- ATT&CKT1552.001
- CIS 5
- NIST CSFPR.AA
- Malicious Pull Requests Catch a backdoor hidden inside a friendly test fix.
- CWE-494
- ATT&CKT1195.002
- CIS 16
- NIST CSFPR.PS
- CI/CD Secret Exposure Lift a deploy key straight out of a public build log.
- CWE-532
- ATT&CKT1552.001
- CIS 16
- NIST CSFPR.PS
The Developer Track
Application security split by attack surface. Free, hands-on, no sign-up.
Frequently asked questions
What is Git and repository security training?
Git security training teaches developers to treat the repository, and the platform around it, as a security boundary rather than a filing cabinet for code.
These exercises cover what actually leaks in practice: credentials living on in commit history, a .git directory shipped to a web root, over-scoped access tokens, unprotected default branches, and secrets printed into public build logs.
Why do secrets survive after you delete them from a repository?
Git stores every version of every file. A commit that deletes a hardcoded key only changes the latest snapshot; the key is still readable in every earlier commit, and every clone copies those commits.
That is why rotation comes first. Rewriting history with git filter-repo or BFG is cleanup, and it cannot recall a copy someone already cloned.
Are these exercises about Git itself or about GitHub and CI/CD?
Both, because the failures cross the line. Some are pure Git: history, authorship, tracked files.
Others live on the platform around it, in pull request review, branch protection rules, personal access tokens, and workflow files that echo a secret into a world-readable build log.