Skip to content

Commit d46a476

Browse files
dsalaza4dsalaza4
authored
Merge pull request #1 from alejolagosm/main
Add secrets files to test new sniffs scanner
2 parents 6bf55eb + 7fee9b4 commit d46a476

10 files changed

Lines changed: 386 additions & 0 deletions

File tree

‎.github/workflows/dev.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# Test workflow for machine
2+
name: Standalone CLI
3+
on: [push, pull_request]
4+
jobs:
5+
machineStandalone:
6+
runs-on: ubuntu-latest
7+
steps:
8+
- uses: actions/checkout@f095bcc56b7c2baf48f3ac70d6d6782f4f553222
9+
- uses: docker://docker.io/fluidattacks/sast:latest
10+
name: machineStandalone
11+
with:
12+
args: sast scan .

‎environment/.env‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# -------------------------------------------------------
2+
# Example .env file with intentionally hardcoded secrets
3+
# FOR TESTING SECRET SCANNERS ONLY (dummy values)
4+
# -------------------------------------------------------
5+
6+
# AWS credentials
7+
AWS_ACCESS_KEY_ID=AKIA9ZQWERTYUIOPASDF
8+
AWS_SECRET_ACCESS_KEY=U8sdf78sdf78sdf87sdf78sdf87sdf78sdf87sdf78sdf
9+
AWS_SESSION_TOKEN=IQoJb3JpZ2luX2VjEOr//////////wEaCXVzLWVhc3QtMSJGMEQCIGdummySESSIONtokenExample0987654321abcdefghijklmnop
10+
11+
# Database credentials
12+
DB_HOST=prod-db.internal.example.com
13+
DB_PORT=5432
14+
DB_USERNAME=prod_admin
15+
DB_PASSWORD=Str0ngP@ssw0rd!A9f3KlmPq8Xz2Tn4Yw6Rb0Cj1H
16+
17+
# Generic API keys
18+
API_KEY=sk_live_51QwErTyUiOpAsDfGhJkLzXcVbNm1234567890abcdef
19+
API_TOKEN=ghp_ZYXWVUTSRQPONMLKJIHGFEDCBAabcdef123456
20+
21+
# JWT / authentication secrets
22+
JWT_SECRET=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.dummyPayloadSignatureExampleABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
23+
SESSION_SECRET=super-session-secret-4f9d8f7s9df87s9df87s9df87s9df87s9df
24+
25+
# Encryption keys
26+
ENCRYPTION_KEY=base64:QWxhZGRpbjpPcGVuU2VzYW1lMTIzNDU2Nzg5MGFiY2RlZg==
27+
PRIVATE_TOKEN=tok_9f8e7d6c5b4a39281716151413121110abcdefabcdef
28+
29+
# Cloud provider examples
30+
AZURE_STORAGE_KEY=DefaultEndpointsProtocol=https;AccountName=dummystorageacct;AccountKey=QWERTYUIOPASDFGHJKLZXCVBNM1234567890abcdef==
31+
GOOGLE_API_KEY=AIzaSyDummyExampleKey1234567890abcdefghijklmnop
32+
33+
# Application secrets
34+
DJANGO_SECRET_KEY=django-insecure-5z8x7c6v5b4n3m2a1s0d9f8g7h6j5k4l3p2o1i
35+
FLASK_SECRET_KEY=flask-secret-key-0987654321abcdefghijklmnopqrstuvwxyz
36+
37+
# OAuth secrets
38+
OAUTH_CLIENT_ID=123456789012-abcdefghijklmnopqrstuvwxyz.apps.googleusercontent.com
39+
OAUTH_CLIENT_SECRET=GOCSPX-dummyOAuthSecretKeyExample1234567890
40+
41+
# Misc high entropy values
42+
REDIS_PASSWORD=redispass-9sd8f7s9df87s9df87s9df87s9df87s9df
43+
SIGNING_KEY=MIICXAIBAAKBgQDZdummySigningKeyExample1234567890abcdefghijklmno

‎environment/.npmrc‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# -------------------------------------------------------
2+
# npm configuration with dummy secrets
3+
# -------------------------------------------------------
4+
5+
registry=https://registry.npmjs.org/
6+
7+
# npm authentication token
8+
//registry.npmjs.org/:_authToken=npm_abcdefghijklmnopqrstuvwxyz1234567890
9+
10+
# GitHub Packages token
11+
//npm.pkg.github.com/:_authToken=ghp_ZYXWVUTSRQPONMLKJIHGFEDCBA123456789
12+
13+
# Sonar private registry example
14+
//sonar.internal.example.com/:_authToken=squ_abcdef1234567890abcdef1234567890abcdef12
15+
16+
# Internal registry credentials
17+
_auth=dXNlcm5hbWU6cGFzc3dvcmQtMTIzNDU2Nzg5MGFiY2RlZg==
18+
email=devops@example.com
19+
always-auth=true

‎environment/Dockerfile‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# -------------------------------------------------------
2+
# Example Dockerfile with intentionally hardcoded secrets
3+
# FOR TESTING SECRET SCANNERS ONLY (dummy values)
4+
# -------------------------------------------------------
5+
6+
FROM ubuntu:22.04
7+
8+
LABEL maintainer="security-test@example.com"
9+
ENV DEBIAN_FRONTEND=noninteractive
10+
11+
# ---- Hardcoded AWS credentials ----
12+
ENV AWS_ACCESS_KEY_ID=AKIA7QWERTYUIOPZXCV
13+
ENV AWS_SECRET_ACCESS_KEY=K9sdf8s7df98s7df9s8df7s9df87s9df87s9df87s9df
14+
ENV AWS_SESSION_TOKEN=IQoJb3JpZ2luX2VjEJr//////////wEaCXVzLWVhc3QtMSJIMEYCIQDdummyhighentropyTOKENEXAMPLE1234567890abcdEfGhIjKlMnOpQrStUvWxYz0987654321
15+
16+
# ---- Hardcoded database credentials ----
17+
ENV DB_USERNAME=admin_user
18+
ENV DB_PASSWORD=P@55w0rd!X9vTq3LmZr8YkN2wB6DfHsJpQ1cE7uA4iR0oM
19+
20+
# ---- Hardcoded generic API token ----
21+
ENV API_TOKEN=ghp_A1b2C3d4E5f6G7h8I9j0KLMNOPQRSTUVWXYZabcd
22+
23+
# ---- Hardcoded private key (dummy but realistic format) ----
24+
RUN mkdir -p /root/.ssh && \
25+
echo "-----BEGIN OPENSSH PRIVATE KEY-----" > /root/.ssh/id_rsa && \
26+
echo "b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAlwAAAAdzc2gtcn" >> /root/.ssh/id_rsa && \
27+
echo "NhAAAAAwEAAQAAAIEA0dummyHIGHENTROPYSTRINGkjsdhf9823y4r9823y4r9823y4r98" >> /root/.ssh/id_rsa && \
28+
echo "asdf987asdf987asdf987asdf987asdf987asdf987asdf987asdf987asdf987asdf98" >> /root/.ssh/id_rsa && \
29+
echo "-----END OPENSSH PRIVATE KEY-----" >> /root/.ssh/id_rsa && \
30+
chmod 600 /root/.ssh/id_rsa
31+
32+
# ---- Hardcoded SSH public key ----
33+
RUN echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7dummyHIGHENTROPYKEYSTRING1234567890abcdefghijklmnopqrstuvwxyz user@example.com" \
34+
> /root/.ssh/authorized_keys
35+
36+
# ---- Hardcoded .env file ----
37+
RUN echo "SECRET_KEY=django-insecure-4f9d8f7s9df87s9df87s9df87s9df87s9df87s9df87s9df" > /app.env && \
38+
echo "JWT_SECRET=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.dummyPayloadSignatureExample0987654321" >> /app.env
39+
40+
# ---- Hardcoded config file with credentials ----
41+
RUN mkdir -p /opt/app && \
42+
echo '{ \
43+
"username": "service_account", \
44+
"password": "Sup3rS3cr3tP@ssw0rd!0987654321asdfghjkl", \
45+
"aws_access_key_id": "AKIAIOSFODNN7EXAMPLE", \
46+
"aws_secret_access_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" \
47+
}' > /opt/app/config.json
48+
49+
CMD ["bash"]

‎environment/backend/settings.py‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
"""
2+
Django settings.py (dummy secrets for scanner benchmarking)
3+
DO NOT USE IN PRODUCTION
4+
"""
5+
6+
from pathlib import Path
7+
8+
BASE_DIR = Path(__file__).resolve().parent.parent
9+
10+
# -------------------------------------------------------
11+
# Core Django secrets
12+
# -------------------------------------------------------
13+
14+
SECRET_KEY = "django-insecure-5z8x7c6v5b4n3m2a1s0d9f8g7h6j5k4l3p2o1i9u8y7t6r"
15+
16+
DEBUG = False
17+
18+
ALLOWED_HOSTS = ["example.com", "api.example.com"]
19+
20+
# -------------------------------------------------------
21+
# Database configuration
22+
# -------------------------------------------------------
23+
24+
DATABASES = {
25+
"default": {
26+
"ENGINE": "django.db.backends.postgresql",
27+
"NAME": "production_db",
28+
"USER": "prod_admin",
29+
"PASSWORD": "Pr0dDBP@ssw0rd!A9f3KlmPq8Xz2Tn4Yw6Rb0Cj",
30+
"HOST": "prod-db.internal.example.com",
31+
"PORT": "5432",
32+
}
33+
}
34+
35+
# -------------------------------------------------------
36+
# AWS configuration
37+
# -------------------------------------------------------
38+
39+
AWS_ACCESS_KEY_ID = "AKIA7EXAMPLEQWERTYUI"
40+
AWS_SECRET_ACCESS_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYdummyExampleKey123"
41+
AWS_STORAGE_BUCKET_NAME = "production-bucket"
42+
AWS_S3_REGION_NAME = "us-east-1"
43+
44+
# -------------------------------------------------------
45+
# OpenAI configuration
46+
# -------------------------------------------------------
47+
48+
OPENAI_API_KEY = "sk-proj-AbCdEfGhIjKlMnOpQrStUvWxYz1234567890abcdef"
49+
50+
# -------------------------------------------------------
51+
# Cloudflare configuration
52+
# -------------------------------------------------------
53+
54+
CLOUDFLARE_API_TOKEN = "CFAT-abcdefghijklmnopqrstuvwxyz1234567890"
55+
CLOUDFLARE_ZONE_ID = "1a2b3c4d5e6f7890abcdef1234567890"
56+
57+
# -------------------------------------------------------
58+
# SonarQube configuration
59+
# -------------------------------------------------------
60+
61+
SONAR_HOST_URL = "https://sonar.internal.example.com"
62+
SONAR_TOKEN = "squ_abcdef1234567890abcdef1234567890abcdef12"
63+
64+
# -------------------------------------------------------
65+
# Stripe configuration
66+
# -------------------------------------------------------
67+
68+
STRIPE_SECRET_KEY = "sk_live_abcdefghijklmnopqrstuvwxyz123456"
69+
STRIPE_PUBLIC_KEY = "pk_live_abcdefghijklmnopqrstuvwxyz123456"
70+
71+
# -------------------------------------------------------
72+
# GitHub integration
73+
# -------------------------------------------------------
74+
75+
GITHUB_TOKEN = "ghp_abcdefghijklmnopqrstuvwxyz1234567890ABCD"
76+
77+
# -------------------------------------------------------
78+
# Email configuration
79+
# -------------------------------------------------------
80+
81+
EMAIL_BACKEND = "django.core.mail.backends.smtp.EmailBackend"
82+
EMAIL_HOST = "smtp.mailgun.org"
83+
EMAIL_PORT = 587
84+
EMAIL_HOST_USER = "postmaster@example.com"
85+
EMAIL_HOST_PASSWORD = "MailgunP@ssw0rdExample0987654321"
86+
EMAIL_USE_TLS = True
87+
88+
# -------------------------------------------------------
89+
# Redis / cache
90+
# -------------------------------------------------------
91+
92+
REDIS_HOST = "redis.internal.example.com"
93+
REDIS_PORT = 6379
94+
REDIS_PASSWORD = "redis-secret-9sd8f7s9df87s9df87s9df87s9df87s9df"
95+
96+
# -------------------------------------------------------
97+
# JWT configuration
98+
# -------------------------------------------------------
99+
100+
JWT_SECRET_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.dummyPayloadSignatureABCDEFGHIJKLMNOPQRSTUVWXYZ123456"
101+
102+
# -------------------------------------------------------
103+
# Third-party API keys
104+
# -------------------------------------------------------
105+
106+
SLACK_BOT_TOKEN = "xoxb-123456789012-abcdefghijklmnopqrstuvwxyz1234"
107+
TWILIO_ACCOUNT_SID = "ACabcdef1234567890abcdef1234567890"
108+
TWILIO_AUTH_TOKEN = "abcdef1234567890abcdef1234567890"
109+
110+
# -------------------------------------------------------
111+
# Internal service secrets
112+
# -------------------------------------------------------
113+
114+
INTERNAL_API_KEY = "internal-api-key-abcdefghijklmnopqrstuvwxyz123456"
115+
SIGNING_KEY = "MIICXAIBAAKBgQCdummySigningKeyExample0987654321abcdefghijklmnop"

‎environment/config.json‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{
2+
"environment": "production",
3+
"openai": {
4+
"api_key": "sk-proj-1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZabcdef"
5+
},
6+
"cloudflare": {
7+
"api_token": "CFAT-0987654321abcdefghijklmnopqrstuvwxyz",
8+
"zone_id": "1a2b3c4d5e6f7890abcdef1234567890"
9+
},
10+
"sonarqube": {
11+
"token": "squ_abcdef1234567890abcdef1234567890abcdef12",
12+
"url": "https://sonar.internal.example.com"
13+
},
14+
"aws": {
15+
"access_key_id": "AKIAIOSFODNN7EXAMPLE",
16+
"secret_access_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
17+
},
18+
"npm": {
19+
"token": "npm_abcdefghijklmnopqrstuvwxyz1234567890"
20+
}
21+
}

‎environment/dummy-workflow.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# -------------------------------------------------------
2+
# GitHub Actions workflow with dummy secrets
3+
# -------------------------------------------------------
4+
name: Deploy Application
5+
6+
on:
7+
push:
8+
branches: [ "main" ]
9+
10+
jobs:
11+
deploy:
12+
runs-on: ubuntu-latest
13+
14+
env:
15+
OPENAI_API_KEY: sk-proj-AbCdEfGhIjKlMnOpQrStUvWxYz1234567890
16+
CLOUDFLARE_API_TOKEN: CFAT-ZYXWVUTSRQPONMLKJIHGFEDCBA123456
17+
SONAR_TOKEN: squ_abcdefabcdefabcdefabcdefabcdefabcdef
18+
DOCKERHUB_TOKEN: dckr_pat_abcdefghijklmnopqrstuvwxyz1234
19+
20+
steps:
21+
- name: Checkout
22+
uses: actions/checkout@v4
23+
24+
- name: Run SonarQube Scan
25+
run: |
26+
sonar-scanner \
27+
-Dsonar.login=${SONAR_TOKEN}
28+
29+
- name: Deploy to Cloudflare
30+
run: |
31+
curl -X POST \
32+
-H "Authorization: Bearer ${CLOUDFLARE_API_TOKEN}" \
33+
https://api.cloudflare.com/client/v4/zones

‎environment/infra/terraform.tfvars‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# -------------------------------------------------------
2+
# Terraform variables (dummy secrets for benchmarking)
3+
# -------------------------------------------------------
4+
5+
# AWS credentials
6+
aws_access_key = "AKIA5EXAMPLEZXCVBNMQWER"
7+
aws_secret_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYdummyTerraformKey123"
8+
aws_session_token = "IQoJb3JpZ2luX2VjEO///////////wEaCXVzLWVhc3QtMSJGMEQCIDummySessionTokenExample1234567890"
9+
10+
# Database credentials
11+
db_username = "terraform_admin"
12+
db_password = "TfPr0dDBP@ssw0rd0987654321abcdefghijklmnopqrstuvwxyz"
13+
14+
# Cloudflare
15+
cloudflare_api_token = "CFAT-abcdefghijklmnopqrstuvwxyz1234567890"
16+
cloudflare_zone_id = "1a2b3c4d5e6f7890abcdef1234567890"
17+
18+
# OpenAI
19+
openai_api_key = "sk-proj-ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdef"
20+
21+
# SonarQube
22+
sonar_token = "squ_abcdefabcdefabcdefabcdefabcdefabcdef"
23+
24+
# GitHub
25+
github_token = "ghp_abcdefghijklmnopqrstuvwxyz1234567890ABCD"
26+
27+
# Stripe
28+
stripe_secret_key = "sk_live_abcdefghijklmnopqrstuvwxyz123456"
29+
30+
# Generic encryption key
31+
encryption_key = "base64:VGhpc0lzQVRlcnJhZm9ybUVuY3J5cHRpb25LZXkxMjM0NTY3OA=="
32+
33+
# Kubernetes
34+
kubeconfig_token = "eyJhbGciOiJSUzI1NiIsImtpZCI6ImR1bW15S1ViZVRva2VuMTIzNDU2"

‎environment/java.properties‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# -------------------------------------------------------
2+
# Example Java application.properties with dummy secrets
3+
# FOR TESTING SECRET SCANNERS ONLY
4+
# -------------------------------------------------------
5+
6+
# Database configuration
7+
spring.datasource.url=jdbc:postgresql://prod-db.internal.example.com:5432/customerdb
8+
spring.datasource.username=prod_admin
9+
spring.datasource.password=Sup3rStr0ngP@ssw0rd!9f8e7d6c5b4a39281716
10+
11+
# AWS credentials
12+
aws.accessKeyId=AKIA4ZXCVBNMASDFQWER
13+
aws.secretAccessKey=wJalrXUtnFEMI/K7MDENG/bPxRfiCYdummyEXAMPLEKEY123
14+
aws.sessionToken=IQoJb3JpZ2luX2VjEOr//////////wEaCXVzLWVhc3QtMSJHMEUCIQdummySESSIONExample0987654321abcdefghijklmnop
15+
16+
# API tokens
17+
api.token=ghp_qwertyuiopasdfghjklzxcvbnm1234567890ABCDE
18+
api.key=sk_live_51DummyExampleKeyAbCdEfGhIjKlMnOpQrStUvWxYz
19+
20+
# JWT secrets
21+
security.jwt.secret=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.dummyPayloadSignatureExampleABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
22+
security.jwt.refreshSecret=refresh-secret-0987654321abcdefghijklmnopqrstuvwxyz
23+
24+
# Encryption keys
25+
security.encryption.key=base64:VGhpc0lzQUR1bW15RW5jcnlwdGlvbktleTEyMzQ1Njc4OTA=
26+
security.signing.key=MIICXAIBAAKBgQCdummySigningKeyExample0987654321abcdefghijklmnop
27+
28+
# OAuth configuration
29+
oauth.client.id=123456789012-abcdefghijklmnopqrstuvwxyz.apps.googleusercontent.com
30+
oauth.client.secret=GOCSPX-dummyOAuthSecretKeyExample1234567890
31+
32+
# Third-party integrations
33+
stripe.secret.key=sk_live_dummyStripeSecretKeyExample1234567890abcdef
34+
slack.bot.token=xoxb-123456789012-abcdefghijklmnopqrstuvwxyz1234
35+
twilio.auth.token=abcdef1234567890abcdef1234567890
36+
37+
# Redis
38+
redis.password=redis-secret-9sd8f7s9df87s9df87s9df87s9df87s9df
39+
40+
# Admin credentials
41+
admin.username=administrator
42+
admin.password=Adm1nP@ssw0rd!DummyHighEntropy0987654321
43+
44+
# Generic high entropy secret
45+
internal.service.secret=7f3a9c2e8d4b6f1a0c9e5d3b2a8f7c6e5d4c3b2a1f0e9d8c7b6a5

0 commit comments

Comments
 (0)