Git & Repository
Security Training
Clone the repo, read the history, replay the leaked key. Then rotate, scrub, and lock the branch down the way the maintainer should have.
8 hands-on exercises across Git, pull requests, access tokens, and CI/CD. Free to play, no sign-up required.
Git & Repository Security
Secrets in Git History
Recover a live API key from the commit that removed it.
- Walk the history of a cleaned-up config file
- Replay a key that was never rotated
- Rotate first, then scrub with git filter-repo
Exposed .git Directory
Rebuild an entire codebase from one public URL.
- Find a browsable .git in the web root
- Dump the repository and recover the source
- Deploy build artifacts, never the repo
Committed Secret Files
Clone a public repo and read its committed .env.
- Spot secret files tracked since the first commit
- Untrack them with git rm --cached and rotate
- Add a .gitignore plus a pre-commit hook
Commit Author Spoofing
Land a backdoor wearing a maintainer’s name.
- Harvest an author identity from git log
- Read the Unverified signature badge
- Require signed commits, administrators included
Branch Protection Bypass
Force-push over main and skip review and CI.
- Rewrite history on an unprotected branch
- Ship unreviewed code straight to production
- Require pull requests, reviewers, and checks
Leaked Access Tokens
Clone private repos with a token from a public gist.
- Check what an over-scoped token can reach
- Revoke and rotate, do not just delete the gist
- Reissue fine-grained and short-lived
Malicious Pull Requests
Catch a backdoor hidden inside a friendly test fix.
- Read the full diff, not the description
- Flag out-of-scope edits to deploy scripts
- Harden review with CODEOWNERS and fork limits
CI/CD Secret Exposure
Lift a deploy key straight out of a public build log.
- Find the workflow step that echoes a secret
- Stop untrusted input running as shell commands
- Pin actions by commit SHA and rotate the key
The Developer Track
Application security split by attack surface. Free, hands-on, no sign-up.
-
Application Security
22 exercisesSQL Injection · Stored XSS · Server-Side Request Forgery
-
API Security
10 exercisesBroken Object Level Authorization · Mass Assignment · Excessive Data Exposure
- Soon
Cloud Security
IAM, S3 exposure, Kubernetes
Frequently Asked Questions
What is Git and repository security training?
Git security training teaches developers to treat the repository, and the platform around it, as a security boundary rather than a filing cabinet for code.
These exercises cover what actually leaks in practice: credentials living on in commit history, a .git directory shipped to a web root, over-scoped access tokens, unprotected default branches, and secrets printed into public build logs.
Why do secrets survive after you delete them from a repository?
Git stores every version of every file. A commit that deletes a hardcoded key only changes the latest snapshot; the key is still readable in every earlier commit, and often in the reflog too.
That is why rotation comes first. Rewriting history with git filter-repo or BFG is cleanup, and it cannot recall a copy someone already cloned.
Are these exercises about Git itself or about GitHub and CI/CD?
Both, because the failures cross the line. Some are pure Git: history, authorship, tracked files.
Others live on the platform around it, in pull request review, branch protection rules, personal access tokens, and workflow files that echo a secret into a world-readable build log.
Who should take Git and repository security training?
Developers, DevOps and platform engineers, SREs, and anyone who reviews pull requests or owns repository settings.
Several of the fixes here are not code at all. They are branch rules, CODEOWNERS entries, token scopes, and deploy pipeline changes, which makes the exercises useful for the people who own those settings as much as for the people writing the code.
Are these Git security exercises free?
Yes. Every exercise runs in your browser with no sign-up required.
Enterprise features such as completion analytics, SCORM and LTI packaging for your LMS, SSO, and custom content are available on paid plans.
See RansomLeak in Action
Try the free exercises or book a demo to see analytics, SCORM export, SSO, and custom content in your environment.