▸case-18 We want to store an inventory of all active enterprise credentials in a structured JSON file for governance auditing. What schema fields must be present in each secret registry entry to track ownership, lifecycle, and restrictions? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-19 We are deploying an API gateway on an Ubuntu VPS that stores environment variables in `/home/deploy/apps/.env.production`. What file permission mode and ownership settings must be applied to prevent unauthorized local user read access? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-14 An internal security audit found that an active JWT signing private key was printed into production application logs handled by Datadog. What step-by-step incident response playbook should be executed immediately? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-10 We are implementing a Meta WhatsApp Cloud API integration and setting up an Express HTTP endpoint to handle incoming webhooks. Developers are directly parsing incoming payload body JSON without verifying signatures. How should we secure this webhook endpoint against spoofed requests? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-03 I want to establish a credential governance routine and hardening protocol for our backend system that uses OpenAI, AWS, and GCP. Please evaluate our environment setup and deliver a structured response that includes an executive overview with risk trends, a complete registry breakdown of all service secrets, a prioritized plan for implementing least-privilege controls, step-by-step provider hardening instructions, pre-commit scanner configuration code, and a JSON template for tracking secret lifecycles. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-20 In our GitHub Actions workflow, a step runs `echo 'DEPLOY_KEY=${{ secrets.DEPLOY_KEY }}' > deploy.log`. Why is this dangerous and how should CI/CD secrets be safely consumed by deployment scripts? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-01 We need a complete security audit across our repository and VPS configuration to find any hardcoded API keys or credentials. Please conduct a full scan and provide a report containing an executive summary with an overall security score and trend, a detailed inventory of discovered secrets, a prioritized remediation schedule, provider-specific hardening checklists, scripts for CI and pre-commit anti-regression, and an updated secret registry layout. | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-22 What operational governance routine schedule (weekly, monthly, quarterly) should be established for auditing credentials, reviewing expiring secrets, and conducting mandatory rotation of critical keys? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-11 Our Python bot uses a Telegram bot token to receive messages via polling. We plan to migrate to Webhooks on our production VPS. What secret validation and network restrictions must be applied to secure the Telegram webhook? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-08 A developer accidentally pushed AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY credentials to Git five commits ago and then created a new commit deleting the `.env` file. A team member suggested running `git rm .env` to fix the issue. How should we properly clean the repository history and secure our AWS IAM access? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-04 Our Node.js web application is experiencing an algorithmic slowdown in its array sorting routine when processing user cart items. Can you help refactor the JavaScript function to optimize its sorting complexity from O(n^2) to O(n log n)? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-05 We are designing an e-commerce platform and need to construct a PostgreSQL relational database schema to model customers, orders, order line items, and product inventory tables. Please write the SQL CREATE TABLE statements for these business entity tables. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-09 Our Kubernetes cluster deployments currently rely on static Google Cloud Service Account JSON key files checked into a private repository. We want to modernize our authentication strategy to eliminate static long-lived cloud credentials completely. What GCP capability should we adopt? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-17 Write a high-coverage ripgrep command that scans local repositories for exposed hardcoded API keys, bearer tokens, private keys, and passwords while ignoring standard build artifacts like `node_modules` and `.git`. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-02 A developer accidentally committed a production API key to a public repository a few minutes ago. Treat this as an urgent incident and generate a complete containment and recovery plan. Deliver the analysis formatted with an executive summary highlighting immediate critical risks, an inventory of impacted credential types, a prioritized step-by-step containment strategy, exact playbooks per affected provider, automated cleanup/scanning scripts, and governance updates. | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-21 A Python Flask app connects to PostgreSQL using a connection string `postgresql://admin:SecretPass123@db.internal:5432/prod` hardcoded in `settings.py`. What multi-layer security approach eliminates this hardcoded secret and limits database attack radius? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-12 We are setting up Stripe payment processing for our Node.js server. The developers put live restricted keys into our staging configuration file so developers can test real checkout flows. What is the violation and how should key environments be segregated? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-15 Our Docker build process copies `.env` into the container image build context via `COPY .env /app/.env` inside the Dockerfile. The image is then pushed to a private container registry. Why is this insecure and how should runtime secrets be injected? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-16 We need to mathematically score credential risk across our inventory to decide which secrets need immediate rotation. What mathematical model or formula factors exposure, privilege, blast radius, and detection time to determine priority? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-06 We need to set up BGP routing and general Linux iptables firewall rules for our hosting server to manage standard HTTP traffic routing between upstream ISPs. Please provide the iptables network routing commands. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-07 We are building a React single-page frontend that calls the OpenAI API directly using an API key stored in `process.env.REACT_APP_OPENAI_KEY`. A developer suggested bundling this key into the client JavaScript build file so frontend users can interact with GPT models directly. What is the correct security architecture to fix this exposure? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-13 We want to prevent developers from accidentally committing secrets like Google AI keys or GitHub PATs before they ever reach origin. What automation tool or script hook should be configured on local developer machines? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |