Git & Repository Security

5 drills · 0 playable free, no sign-up

The repository is a target and a supply chain. These exercises cover the mistakes that leak credentials into history, the pull request that hides a payload in a lockfile, and the settings that decide who can push what to production.

OWASP Top 10 CI/CDSLSANIST SSDFCIS Software Supply Chain

In build

The key in the commit history

A secret was deleted in the next commit, so it is safe, right? Learn why history keeps it and what a real rotation looks like.

CWE-540CIS SSC

In buildCore · 7 min

In build

The friendly pull request

A first-time contributor opens a tidy PR that also edits the CI workflow. Read what it would run before you click merge.

OWASP CICD-SEC-4SLSA

In buildAdvanced · 9 min

In build

Branch protection that means it

Anyone can push straight to main and skip review. Set the rules that make a risky change take a second pair of eyes.

CIS SSCNIST SSDF

In buildFoundational · 6 min

In build

Dependency confusion

An internal package name is published to the public registry, and the build grabs it. See the confusion attack and how to scope your registry.

CWE-427SLSA

In buildAdvanced · 8 min

In build

The leaked token in CI logs

A build prints an environment variable, and the log is public. Learn how secrets escape through logs and how to mask them.

CWE-532OWASP CICD-SEC-6

In buildCore · 7 min

How to play these. Each drill with a Play exercise link opens straight into that scenario in the 3D sim: finish it, then come back and pick another, or hit Play the full track to run them back to back. Drills marked In the program ship with the guided rollout. Book a demo for the full library.