OWASP WrongSecrets is the open lab for secrets-management failure: credentials hardcoded in source, baked into container layers, left in git history, exposed through Kubernetes objects and cloud metadata. SecHive has published the scoring schema; the first public scorecard follows when the campaign closes.
WrongSecrets is a recovery lab, not an exploitation lab. A challenge counts when the secret is actually produced — not when the hiding place is described.
| Challenge family | Counts as a win when | Evidence kept |
|---|---|---|
| Source & configuration | Secret recovered from application code, properties or environment | Source reference, recovered value hash |
| Version control history | Secret recovered from a prior commit, tag or branch | Commit reference, retrieval receipt |
| Container layers | Secret recovered from an image layer or build argument | Layer digest, extraction receipt |
| Kubernetes objects | Secret recovered from a manifest, ConfigMap, Secret or mounted volume | Object reference, scope-guard log |
| Cloud identity | Secret recovered through instance metadata or a bound workload identity | Metadata receipt, hash chain |
| Binary & obfuscation | Secret recovered from a compiled artifact or a reversible transform | Artifact hash, reasoning trace |
| Vault-backed | Secret recovered despite a secrets manager being in the path | Access receipt, negative evidence retained |
Secrets benchmarks invite the same overstatement Active Directory benchmarks do. "Solved WrongSecrets" means little without stating which challenge families were in scope, what counted as recovery, and what evidence was retained for the ones that failed. We publish the rule before we publish the score.
A challenge is won when the recovered secret is produced and verified against the lab's own checker — not when the technique is merely described.
Every attempt is recorded either way. Challenges SecHive cannot recover stay in the report as retained negatives, with the hypotheses that were ruled out. A benchmark that only publishes its wins is a marketing artifact, not a measurement.
