Secret Scanning Vocabulary
Practice vocabulary for secret scanning, credential leak prevention, git history scanning, and secret rotation workflows in DevSecOps.
0 / 26 completed
1 / 26
What is 'secret scanning' in a DevSecOps context?
Secret scanning uses pattern matching and entropy analysis to detect accidentally committed secrets — API keys, database passwords, private keys, tokens — in code repositories. Tools include GitHub Secret Scanning, GitGuardian, TruffleHog, and detect-secrets. Early detection prevents credential exposure before they reach public repositories.
2 / 26
What is a 'credential leak in git history' and why is it particularly serious?
Git stores the complete history of every file. Deleting a secret from the current branch does not remove it from prior commits — it remains accessible via git log, git show, or by checking out the old commit. Remediation requires rewriting history (git filter-branch, BFG Repo-Cleaner) AND immediately rotating the exposed credential, since the history may have already been cloned.
3 / 26
What is the difference between 'pre-commit scanning' and 'git history scanning'?
Pre-commit scanning (using tools like pre-commit framework with detect-secrets or gitleaks) runs as a git hook and blocks commits containing secrets before they enter the repository. Git history scanning (TruffleHog, GitGuardian, gitleaks) audits the entire commit history to find secrets that were committed in the past. Both are complementary: pre-commit prevents new leaks; history scanning finds existing ones.
4 / 26
What does 'revoke and rotate' mean in the context of a leaked secret?
'Revoke and rotate' is the immediate response to a leaked credential: (1) revoke — invalidate the exposed secret with the issuer (e.g., delete an AWS IAM access key, revoke a GitHub personal access token) so it is immediately unusable; (2) rotate — generate a fresh credential and update all systems consuming it. Speed matters — assume the secret was used by an attacker from the moment of exposure.
5 / 26
What is 'secret lifecycle management'?
Secret lifecycle management covers the full lifecycle: creation (generating strong secrets), distribution (injecting via vault, not env files), rotation (automated periodic re-issuance), auditing (logging access), and revocation (immediate invalidation when no longer needed or compromised). Tools like HashiCorp Vault, AWS Secrets Manager, and Azure Key Vault automate most of this lifecycle.
6 / 26
During a code review of a new microservice deployment, Sarah flags a potential issue. Mark replies with the following comment:
A) Document the finding and add a comment explaining why the API key was used, noting it's temporary for testing.
B) Run a secret scanning tool against the service's codebase and dependencies to identify any exposed secrets.
C) Contact the development team responsible for the microservice and request they implement stricter access controls to prevent unauthorized key usage.
D) Ignore the comment, as developers often use temporary API keys during early testing phases.
// TODO: Investigate if 'API_KEY' is hardcoded in this service.
Which of the following actions should Mark *immediately* take to address this concern?
A) Document the finding and add a comment explaining why the API key was used, noting it's temporary for testing.
B) Run a secret scanning tool against the service's codebase and dependencies to identify any exposed secrets.
C) Contact the development team responsible for the microservice and request they implement stricter access controls to prevent unauthorized key usage.
D) Ignore the comment, as developers often use temporary API keys during early testing phases.
Mark should immediately run a secret scanning tool. While temporary API keys are sometimes used during testing, hardcoding them in production services is a critical security vulnerability. The scan will definitively identify if the key has been inadvertently exposed, allowing for immediate remediation rather than relying on Mark's interpretation or a delayed request to the development team. Option A is incorrect because simply documenting the issue doesn't address the underlying risk; options C and D are inappropriate responses to a confirmed secret exposure.
7 / 26
The correct answer is A. While rotating credentials (B) and adding a comment (C) are good practices in the long run, the immediate priority is to log the unauthorized access attempt. This provides crucial forensic data for understanding *how* the secret was exposed – vital information for remediation. Input validation (D) addresses a different vulnerability (SQL injection), not the direct exposure of credentials.
8 / 26
During a sprint retrospective, Alex reports that the team consistently forgets to rotate their database credentials. The security lead, Emily, asks him to demonstrate how frequently these keys are being used and whether any automated scanning is in place. Alex explains he doesn't know and hasn't checked. Which of the following steps should Emily immediately prioritize?
The core problem isn't just the rotation itself; it's the *lack of oversight* and proactive detection. Option B is correct because a secret scanning tool would immediately reveal whether keys are being used inappropriately or if they've been inadvertently exposed in code. Options A and C represent reactive measures – training alone won't prevent misuse, and immediate revocation without investigation could disrupt services. Option D is premature escalation; Emily should first understand the scope of the issue before involving higher management.
9 / 26
During a code review of a new CI/CD pipeline script, Liam flags a potential issue. The script automatically deploys a service that utilizes an environment variable named `STRIPE_SECRET_KEY` to authenticate with the Stripe API.
Liam comments: "This looks risky – hardcoded secrets in deployment scripts are a major vulnerability!"
Which of the following actions should Liam *immediately* recommend as the best course of action?
Liam's recommendation – using a secrets manager or environment variables managed by a vault – is the most secure and best practice. Hardcoding secrets in deployment scripts (option C) creates immediate vulnerability. Option B offers minimal protection and doesn't address the root cause. Option D is completely inappropriate, as direct use of the key for testing introduces significant risk.
10 / 26
During a code review of a new microservice deployment, Sarah flags a potential issue. Mark replies with the following comment:
A) Document the finding and add a comment explaining why the API key was used, noting it's temporary for testing.
B) Run a secret scanning tool against the service's codebase and dependencies to identify any exposed secrets.
C) Contact the development team responsible for the microservice and request they implement stricter access controls to prevent unauthorized key usage.
D) Ignore the comment, as developers often use temporary API keys during early testing phases.
// TODO: Investigate if 'API_KEY' is hardcoded in this service.
Which of the following actions should Mark *immediately* take to address this concern?
A) Document the finding and add a comment explaining why the API key was used, noting it's temporary for testing.
B) Run a secret scanning tool against the service's codebase and dependencies to identify any exposed secrets.
C) Contact the development team responsible for the microservice and request they implement stricter access controls to prevent unauthorized key usage.
D) Ignore the comment, as developers often use temporary API keys during early testing phases.
Mark should immediately run a secret scanning tool. While temporary API keys are sometimes used during testing, hardcoding them in production services is a critical security vulnerability. The scan will definitively identify if the key has been inadvertently exposed, allowing for immediate remediation rather than relying on Mark's interpretation or a delayed request to the development team. Option A is incorrect because simply documenting the issue doesn't address the underlying risk; options C and D are inappropriate responses to a confirmed secret exposure.
11 / 26
The correct answer is A. While rotating credentials (B) and adding a comment (C) are good practices in the long run, the immediate priority is to log the unauthorized access attempt. This provides crucial forensic data for understanding *how* the secret was exposed – vital information for remediation. Input validation (D) addresses a different vulnerability (SQL injection), not the direct exposure of credentials.
12 / 26
During a sprint retrospective, Alex reports that the team consistently forgets to rotate their database credentials. The security lead, Emily, asks him to demonstrate how frequently these keys are being used and whether any automated scanning is in place. Alex explains he doesn't know and hasn't checked. Which of the following steps should Emily immediately prioritize?
The core problem isn't just the rotation itself; it's the *lack of oversight* and proactive detection. Option B is correct because a secret scanning tool would immediately reveal whether keys are being used inappropriately or if they've been inadvertently exposed in code. Options A and C represent reactive measures – training alone won't prevent misuse, and immediate revocation without investigation could disrupt services. Option D is premature escalation; Emily should first understand the scope of the issue before involving higher management.
13 / 26
During a code review of a new CI/CD pipeline script, Liam flags a potential issue. The script automatically deploys a service that utilizes an environment variable named `STRIPE_SECRET_KEY` to authenticate with the Stripe API.
Liam comments: "This looks risky – hardcoded secrets in deployment scripts are a major vulnerability!"
Which of the following actions should Liam *immediately* recommend as the best course of action?
Liam's recommendation – using a secrets manager or environment variables managed by a vault – is the most secure and best practice. Hardcoding secrets in deployment scripts (option C) creates immediate vulnerability. Option B offers minimal protection and doesn't address the root cause. Option D is completely inappropriate, as direct use of the key for testing introduces significant risk.
14 / 26
During a code review of a new microservice deployment, Sarah flags a potential issue. Mark replies with the following comment:
A) Document the finding and add a comment explaining why the API key was used, noting it's temporary for testing.
B) Run a secret scanning tool against the service's codebase and dependencies to identify any exposed secrets.
C) Contact the development team responsible for the microservice and request they implement stricter access controls to prevent unauthorized key usage.
D) Ignore the comment, as developers often use temporary API keys during early testing phases.
// TODO: Investigate if 'API_KEY' is hardcoded in this service.
Which of the following actions should Mark *immediately* take to address this concern?
A) Document the finding and add a comment explaining why the API key was used, noting it's temporary for testing.
B) Run a secret scanning tool against the service's codebase and dependencies to identify any exposed secrets.
C) Contact the development team responsible for the microservice and request they implement stricter access controls to prevent unauthorized key usage.
D) Ignore the comment, as developers often use temporary API keys during early testing phases.
Mark should immediately run a secret scanning tool. While temporary API keys are sometimes used during testing, hardcoding them in production services is a critical security vulnerability. The scan will definitively identify if the key has been inadvertently exposed, allowing for immediate remediation rather than relying on Mark's interpretation or a delayed request to the development team. Option A is incorrect because simply documenting the issue doesn't address the underlying risk; options C and D are inappropriate responses to a confirmed secret exposure.
15 / 26
The correct answer is A. While rotating credentials (B) and adding a comment (C) are good practices in the long run, the immediate priority is to log the unauthorized access attempt. This provides crucial forensic data for understanding *how* the secret was exposed – vital information for remediation. Input validation (D) addresses a different vulnerability (SQL injection), not the direct exposure of credentials.
16 / 26
During a sprint retrospective, Alex reports that the team consistently forgets to rotate their database credentials. The security lead, Emily, asks him to demonstrate how frequently these keys are being used and whether any automated scanning is in place. Alex explains he doesn't know and hasn't checked. Which of the following steps should Emily immediately prioritize?
The core problem isn't just the rotation itself; it's the *lack of oversight* and proactive detection. Option B is correct because a secret scanning tool would immediately reveal whether keys are being used inappropriately or if they've been inadvertently exposed in code. Options A and C represent reactive measures – training alone won't prevent misuse, and immediate revocation without investigation could disrupt services. Option D is premature escalation; Emily should first understand the scope of the issue before involving higher management.
17 / 26
During a code review of a new CI/CD pipeline script, Liam flags a potential issue. The script automatically deploys a service that utilizes an environment variable named `STRIPE_SECRET_KEY` to authenticate with the Stripe API.
Liam comments: "This looks risky – hardcoded secrets in deployment scripts are a major vulnerability!"
Which of the following actions should Liam *immediately* recommend as the best course of action?
Liam's recommendation – using a secrets manager or environment variables managed by a vault – is the most secure and best practice. Hardcoding secrets in deployment scripts (option C) creates immediate vulnerability. Option B offers minimal protection and doesn't address the root cause. Option D is completely inappropriate, as direct use of the key for testing introduces significant risk.
18 / 26
During a code review of a new microservice deployment, Sarah flags a potential issue. Mark replies with the following comment:
A) Document the finding and add a comment explaining why the API key was used, noting it's temporary for testing.
B) Run a secret scanning tool against the service's codebase and dependencies to identify any exposed secrets.
C) Contact the development team responsible for the microservice and request they implement stricter access controls to prevent unauthorized key usage.
D) Ignore the comment, as developers often use temporary API keys during early testing phases.
// TODO: Investigate if 'API_KEY' is hardcoded in this service.
Which of the following actions should Mark *immediately* take to address this concern?
A) Document the finding and add a comment explaining why the API key was used, noting it's temporary for testing.
B) Run a secret scanning tool against the service's codebase and dependencies to identify any exposed secrets.
C) Contact the development team responsible for the microservice and request they implement stricter access controls to prevent unauthorized key usage.
D) Ignore the comment, as developers often use temporary API keys during early testing phases.
Mark should immediately run a secret scanning tool. While temporary API keys are sometimes used during testing, hardcoding them in production services is a critical security vulnerability. The scan will definitively identify if the key has been inadvertently exposed, allowing for immediate remediation rather than relying on Mark's interpretation or a delayed request to the development team. Option A is incorrect because simply documenting the issue doesn't address the underlying risk; options C and D are inappropriate responses to a confirmed secret exposure.
19 / 26
The correct answer is A. While rotating credentials (B) and adding a comment (C) are good practices in the long run, the immediate priority is to log the unauthorized access attempt. This provides crucial forensic data for understanding *how* the secret was exposed – vital information for remediation. Input validation (D) addresses a different vulnerability (SQL injection), not the direct exposure of credentials.
20 / 26
During a sprint retrospective, Alex reports that the team consistently forgets to rotate their database credentials. The security lead, Emily, asks him to demonstrate how frequently these keys are being used and whether any automated scanning is in place. Alex explains he doesn't know and hasn't checked. Which of the following steps should Emily immediately prioritize?
The core problem isn't just the rotation itself; it's the *lack of oversight* and proactive detection. Option B is correct because a secret scanning tool would immediately reveal whether keys are being used inappropriately or if they've been inadvertently exposed in code. Options A and C represent reactive measures – training alone won't prevent misuse, and immediate revocation without investigation could disrupt services. Option D is premature escalation; Emily should first understand the scope of the issue before involving higher management.
21 / 26
During a code review of a new CI/CD pipeline script, Liam flags a potential issue. The script automatically deploys a service that utilizes an environment variable named `STRIPE_SECRET_KEY` to authenticate with the Stripe API.
Liam comments: "This looks risky – hardcoded secrets in deployment scripts are a major vulnerability!"
Which of the following actions should Liam *immediately* recommend as the best course of action?
Liam's recommendation – using a secrets manager or environment variables managed by a vault – is the most secure and best practice. Hardcoding secrets in deployment scripts (option C) creates immediate vulnerability. Option B offers minimal protection and doesn't address the root cause. Option D is completely inappropriate, as direct use of the key for testing introduces significant risk.
22 / 26
During a code review of a new microservice deployment, Maria comments: 'I'm seeing that the API key for our payment gateway is directly embedded within this service's configuration file. While it passes the initial tests, this presents a significant security risk if the key were to be compromised. What's the most appropriate response?'
Maria correctly identifies a critical vulnerability. Hardcoding API keys directly into code exposes them if the codebase is leaked or compromised. The best response is to advocate for using secure storage mechanisms like environment variables, which are far more resilient against unauthorized access. Option A misinterprets Maria's concern; options C and D are factually incorrect.
23 / 26
In a Slack channel discussing the recent deployment of a new feature, Ben sends a message: 'Just deployed! Using
STRIPE_SECRET_KEY to authenticate. Seems to be working.' What does Ben *likely* mean and what is the immediate concern regarding this approach?Ben's usage of
STRIPE_SECRET_KEY is correct *in principle* – using environment variables is better than hardcoding. However, his message itself exposes the key in a public channel, which is extremely dangerous. The immediate concern is that anyone with access to the Slack channel could potentially view and misuse this sensitive credential. Options A and D are misleading; option B misinterprets the risk.24 / 26
You're reviewing a Pull Request for a new service that interacts with an external API. The PR description reads: 'This update integrates with the
API_KEY to fetch data from the provider.' What is the *primary* issue highlighted by this description?While the description *mentions* an API key, it doesn't provide enough context. The core problem is the potential for the
API_KEY to be hardcoded—a serious security risk. A good PR description should clearly state how sensitive information is handled (e.g., using environment variables). Options A and B are irrelevant; option C directly addresses the missing crucial detail.25 / 26
During a daily stand-up, David reports: 'I've been working on integrating with the new analytics service. I'm using my personal API key to authenticate.' The team lead asks, 'Can you confirm how frequently you're rotating those keys?' What is the *most* important follow-up question?
The most critical question is about key rotation. Regularly rotating API keys is a fundamental security practice to mitigate the impact of compromised credentials. David's use of his personal key without rotation represents a significant vulnerability. Options A and D are tangential; option B focuses on timing rather than the core issue.
26 / 26
During a code review of a new CI/CD pipeline script, Chloe flags a potential issue. The script automatically deploys a service that utilizes an environment variable named `DATABASE_PASSWORD` to connect to the production database. She asks: 'Is this password stored securely and regularly rotated?' What is the *best* way to respond to Chloe's concerns?
Chloe raises a crucial point about secure storage and rotation. While encryption adds a layer of protection, it doesn't address the core issue of key rotation. The team *must* verify that a robust rotation policy exists and is being followed to minimize the risk of unauthorized access. Option A is misleading; option C ignores the concern entirely; option D is incorrect due to its misrepresentation of the variable's use.
Frequently Asked Questions
What does the "Secret Scanning Vocabulary" exercise cover?
Practice vocabulary for secret scanning, credential leak prevention, git history scanning, and secret rotation workflows in DevSecOps.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
How many questions are in "Secret Scanning Vocabulary"?
This exercise has 26 questions. Each one gives instant feedback with an explanation, so you can see exactly why an answer is right or wrong.
Do I need to create an account to save my progress?
No account is required. The progress bar and score are tracked in your browser for the current session -- the exercise is designed to be a quick, repeatable drill rather than something you resume later.
What happens if I get an answer wrong?
You'll see the correct answer highlighted immediately, along with a short explanation of why it's correct. Wrong answers aren't penalized beyond your score, and you can keep going through every question.
How is this exercise different from reading an article?
Articles explain vocabulary and concepts through prose, while exercises like this one are interactive drills -- multiple-choice questions -- that test and reinforce your recall of specific terms and phrasing.
Can I retry this exercise?
Yes -- use the "Try again" button on the results screen to reset your score and go through all the questions again from the start.
Where can I find more Devsecops Pipeline Language exercises?
Browse the full Devsecops Pipeline Language hub for related drills, or check the site-wide exercises index for other IT English topics.
Is this exercise suitable for beginners?
This exercise assumes basic familiarity with IT terminology. If a term feels unfamiliar, check the site Glossary for a plain-English definition before attempting the questions.
How often is new content like this published?
New exercises are added regularly across all categories, alongside new vocabulary sets and articles. Check back on the exercises hub to see what's new.