Git & Repository
Security Training
Clone the repo, read the history, replay the leaked key. Then rotate, scrub, and lock the branch down the way the maintainer should have.
8 hands-on exercises across Git, pull requests, access tokens, and CI/CD. Free to play, no sign-up required.
Git & Repository Security
Secrets in Git History
Recover a live API key from the commit that removed it.
- CWE-540
- ATT&CKT1552.001
- CIS 3
- NIST CSFPR.DS
Exposed .git Directory
Rebuild an entire codebase from one public URL.
- CWE-527
- ATT&CKT1213.003
- CIS 16
- NIST CSFPR.PS
Committed Secret Files
Clone a public repo and read its committed .env.
- CWE-540
- ATT&CKT1552.001
- CIS 3
- NIST CSFPR.DS
Commit Author Spoofing
Land a backdoor wearing a maintainer’s name.
- CWE-345
- ATT&CKT1036
- CIS 16
- NIST CSFPR.PS
Branch Protection Bypass
Force-push over main and skip review and CI.
- CWE-285
- ATT&CKT1195.002
- CIS 16
- NIST CSFPR.PS
Leaked Access Tokens
Clone private repos with a token from a public gist.
- CWE-522
- ATT&CKT1552.001
- CIS 5
- NIST CSFPR.AA
Malicious Pull Requests
Catch a backdoor hidden inside a friendly test fix.
- CWE-494
- ATT&CKT1195.002
- CIS 16
- NIST CSFPR.PS
CI/CD Secret Exposure
Lift a deploy key straight out of a public build log.
- CWE-532
- ATT&CKT1552.001
- CIS 16
- NIST CSFPR.PS
The Developer Track
Application security split by attack surface. Free, hands-on, no sign-up.
Frequently asked questions
What is Git and repository security training?
Git security training teaches developers to treat the repository, and the platform around it, as a security boundary rather than a filing cabinet for code.
These exercises cover what actually leaks in practice: credentials living on in commit history, a .git directory shipped to a web root, over-scoped access tokens, unprotected default branches, and secrets printed into public build logs.
Why do secrets survive after you delete them from a repository?
Git stores every version of every file. A commit that deletes a hardcoded key only changes the latest snapshot; the key is still readable in every earlier commit, and often in the reflog too.
That is why rotation comes first. Rewriting history with git filter-repo or BFG is cleanup, and it cannot recall a copy someone already cloned.
Are these exercises about Git itself or about GitHub and CI/CD?
Both, because the failures cross the line. Some are pure Git: history, authorship, tracked files.
Others live on the platform around it, in pull request review, branch protection rules, personal access tokens, and workflow files that echo a secret into a world-readable build log.
Who should take Git and repository security training?
Developers, DevOps and platform engineers, SREs, and anyone who reviews pull requests or owns repository settings.
Several of the fixes here are not code at all. They are branch rules, CODEOWNERS entries, token scopes, and deploy pipeline changes, which makes the exercises useful for the people who own those settings as much as for the people writing the code.
Are these Git security exercises free?
Yes. Every exercise runs in your browser with no sign-up required.
Enterprise features such as completion analytics, SCORM and LTI packaging for your LMS, SSO, and custom content are available on paid plans.
See RansomLeak in Action
Try the free exercises or book a demo to see analytics, SCORM export, SSO, and custom content in your environment.