Secret Sweeper
A diff lands on the board. Flag every line that is a live leaked credential. Then pick the correct first remediation step. Placeholders, public keys and revoked tokens are bait — flagging them costs you.
Core loop
Flag lines → Enter to sweep → learn → route the fix. Under ten seconds when you know it.
Flag lines → Enter to sweep → learn → route the fix. Under ten seconds when you know it.
Run out of shields and you are out.
A missed live secret is a breach. A false positive just burns points and your combo. You get more shields at the lower tiers.
A missed live secret is a breach. A false positive just burns points and your combo. You get more shields at the lower tiers.
Combo
A perfect diff (every leak, zero false positives) stacks the multiplier up to 3×. One sloppy sweep resets it.
A perfect diff (every leak, zero false positives) stacks the multiplier up to 3×. One sloppy sweep resets it.
Controls
1–9 toggle a line · Enter sweep / continue · 1–4 pick a remediation · tap anything on touch.
Scoring: leak found +100 · false positive −60 · missed leak −120 & a breach · perfect diff +50×combo · remediation +120 / −50 · leftover seconds ×6. Everything is then multiplied by the tier: ×0.6 at 100 up to ×1.6 at 500.
—
—
Click a line, or press its number. Flag only live credentials.
What this drills
- Push protection reach. Partner/provider patterns are blocked at push time; generic passwords and base64 blobs are not, unless you author a custom pattern with push protection enabled on it.
- Custom patterns. Regex plus optional before/after context, defined at repo, org or enterprise scope — always dry-run before enabling.
- Revoke before purge. Rotating the credential is always step one. Rewriting history does not un-leak anything.
- History, forks and cached views. Deleting the line in a new commit leaves the secret in every earlier commit, every fork, and cached commit views.
- Validity checks & partner patterns. Active vs inactive tokens, and provider notification for partner patterns.
- False positives that look lethal. Public keys, placeholders, documentation example keys, password hashes, encrypted SOPS/Ansible-vault blobs, Key Vault URIs, passwordless connection strings.
- Secrets in CI/CD. Pipeline YAML, .npmrc/nuget.config, Dockerfile ARG defaults, log masking and the tricks that defeat it.
- Bypass & audit. "It is only a test" is a logged bypass, not a suppression. Delegated bypass routes it to a reviewer.
Whiteboards: Secret Scanning · Enablement, Policy & Rollout · Dependabot & Supply Chain · The Pizza Parlor