SecureJuniorSecurityAuto-graded
Remove leaked secrets and add a pre-commit hook
Cleanup counts as finished only when the same mistake can no longer happen, and that standard is applied here.A small repository has credentials committed into it. Find every one, remove them properly, move the configuration to environment variables, and make sure the same mistake cannot be repeated — a pre-commit hook that refuses to let a secret through is the deliverable that makes the fix stick.20 min
git
You're done when
- The database password is removed from the repository.
- The payment provider API key is removed.
- The JWT signing secret is removed.
- The incoming webhook URL is removed.
- Configuration is read from environment variables instead of hardcoded values.
- The environment file is git-ignored so it cannot be committed by accident.
- A pre-commit hook is implemented that blocks a secret from being committed.
What it measures
GitWorking with repository history and hooks to both remove a secret and prevent the next one.
Security gap analysisFinding every leaked credential rather than the ones that are easy to grep for.
Preventing recurrenceTreating the hook as the real fix, since removing today's secret does nothing about tomorrow's.
Your environment
Terminal + editorA full shell in the browser
Claude CodePre-authenticated, no key setup
Isolated microVMYours alone, wiped afterwards
Start this lab
20 min
Start labYou'll sign in to Anthropos to start. The lab opens in a private cloud workspace with Claude Code ready to use.AI Labs is part of Anthropos Workforce. Not on your plan yet? Book a demo