BENCH.D — OWASP WrongSecrets
Secrets, where they should not be.
OWASP WrongSecrets is a benchmark for finding hard-coded, leaked and misconfigured secrets across containers, code, infrastructure and binaries. SecHive integrates the WrongSecrets challenge tree and runs aggregate scoring; the first public scorecard is scheduled for 2026.Q3.
Status — framework only. Aggregator and runner are wired (
scripts/wrongsecrets-suite-run.py, scripts/wrongsecrets-aggregate.py). Public scorecard publishes when the campaign closes.§ Scope
Secret-class taxonomy.
WrongSecrets covers eight broad classes; the scorecard reports per-class win rate so the result cannot be inflated by the easy classes.
| Class | Example surface | SecHive routing |
|---|---|---|
| In-source constants | hard-coded keys in repo | recon_router → source review |
| Configuration | config files in image layers | recon_router → config skill |
| Environment | env vars in container | recon_router → runtime probe |
| Vault misuse | vault path readable to app | api_security + vault skill |
| Build artifacts | dotfiles in shipped images | image layer skill |
| Frontend leak | secrets in JS bundles | frontend recon |
| Cloud metadata | IMDS / metadata service | cloud skill |
| Binary embedding | strings in a binary | re_triage |
Scoring
One challenge equals one objective. Each objective is closed only with a runtime artifact: the secret string is observed in a SecHive-controlled receipt, with the source path that produced it. Evidence is hashed; raw secret material is redacted in the published scorecard.
Roadmap
- 2026.Q2Aggregator + runner wired, taxonomy published.done
- 2026.Q3First public scorecard.scheduled
- 2026.Q4Per-class regression tracking across releases.planned