OWASP WrongSecrets
Find secrets left in code, containers and cloud config
OWASP WrongSecrets is a deliberately insecure app full of badly stored secrets. Each challenge asks you to find a secret hidden in source code, a Docker image, Kubernetes config, a vault, a binary or a cloud setup, and enter it to score points.
Free · No login · Browser
About OWASP WrongSecrets
It trains secrets management and shows why common shortcuts leak credentials. It suits developers and DevOps engineers, and the challenges range from one to five stars.
A public demo runs in the browser with no login. You can also run it locally with Docker or deploy it to Kubernetes and the major clouds for the harder challenges. It is free and open source.
On Breakpoint since 25 Oct 2026.
Made this game? Claim it →
Tips and discussion
No tips yet. Solved it? Share how, and wrap answers in ||spoilers||.