Assume the repository is public
Secrets and scanning
A secret committed once is a secret forever: history keeps it, forks copy it, and CI logs quote it. Treat every repository as if it were about to be published, and scan before the merge, not after the incident.
Move it, ignore it, lock it, document it
The fix is a sequence, not a delete: read the value from the environment, ignore the real file, lock its permissions, and ship a safe example file that documents the variable without the value.
Deleting the line does not delete the commit. If a key was ever pushed, rotate it — the removal is hygiene, the rotation is the actual remediation.
Scanning is a gate
Image and dependency scanning only changes outcomes when it blocks a merge. A report nobody enforces is a suggestion, and suggestions lose to deadlines.
Classify by fixability: a critical finding in a base image you can bump is a ticket for today; a low finding with no patch path is a documented risk, not a reason to stop shipping.
Commands in this lesson
Every one of these runs in the sandbox — no real account, no real bill.
| Command | Why |
|---|---|
echo 'const apiKey = process.env.API_KEY;' > config.js | The code reads the environment; the value never lives in the file. |
echo '.env' >> .gitignore | The real file cannot be staged by accident. |
chmod 600 .env | Only the owner may read it — the file is not world-readable on a shared host. |
echo 'API_KEY=replace-me' > .env.example | Documents the variable without documenting the secret. |
git add .gitignore .env.example config.js | Stage exactly the safe files. `git add .` is how `.env` ships. |
Now do it
Reading the model makes the first attempt faster. Only the lab makes you able to do it.
- Open the lab
DevSecOps: Remove a Leaked Secret
Intermediate · 25 min · members
- Open the lab
Security: Remediate a Trivy Vulnerability Report
Intermediate · 25 min · members
Secrets and scanning · OphirCloud Academy · all lessons