wrongsecrets
CLAUDE.md1.5k starsChanged 4 years agoAGPL-3.0View on GitHub
Guidance for Claude Code when working in this repository. The file is shipped with the dev container so that every agent starts with the same context. The deploy-preview helper authenticates…
We split this CLAUDE.md into the rules it gives an agent
5 rules. About 0 are common, 3 are distinctive, and 2 are very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈3
Distinctive · estimate
This author's own choices. Worth a look.
2
Very specific
Tied to their project's names, files or tools. Probably skip.
Licensed with conditions — read it at the source. We count its rules but don't quote them. Read them on GitHub.
≈ “Common” is an estimate: at least 1 in 5 of the 25,680 CLAUDE.md files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Trending
Steady: 0 new projects took it in the last 4 weeks, none the 4 weeks before.thin data
Who's talking about OWASP/wrongsecrets
- @commjoenie.bsky.social“We released version 1.11.2 of #OWASP #WrongSecrets: it's faster than ever, has now 55 challenges and a lot …”Bluesky · May 2, 2025 · 23 likes
- @commjoenie.bsky.social“We released 1.13.3 of #OWASP #WrongSecrets with 2 new #security challenges! Reverse engineer a #swift …”Bluesky · Apr 23, 2026 · 8 likes
- @commjoenie.bsky.social“We released version 1.13.1 of #OWASP #WrongSecrets! Now with #springboot4 and challenges involving …”Bluesky · Mar 7, 2026 · 7 likes
- A Hacker News story“How to Not Use Secrets”Hacker News · Dec 4, 2023 · 6 points
- @commjoenie.bsky.social“We reached challenge 75 at #OWASP #WrongSecrets ! See arcane-scrubland-42646.herokuapp.com for the first …”Bluesky · Oct 6, 2026 · 4 likes
The biggest 5 of 60 mentions linking to the repository that our crawl found. Each line is their own headline.
See all 60
Talked about on GitHub, Bluesky, Hacker News and Stack Overflow (60 times).
On GitHub · 50
- Apr 17, 2023Add references to OWASP WrongSecrets — madhuakula/kubernetes-goat2 reactions · 2 comments
- Oct 29, 2025Qbr 24 — techaksh63/wrongsecrets1 reaction · 1 comment
- Oct 27, 2025Qbr 22 — techaksh63/wrongsecrets1 reaction · 1 comment
- Oct 27, 2025Qbd 21 — techaksh63/wrongsecrets1 reaction · 1 comment
- Oct 7, 2025autofix with modification — techaksh63/wrongsecrets1 reaction · 1 comment
45 more on GitHub
- Jun 2, 2024using GH_TOKEN 4 PR — mitin20/QodanaDemo1 reaction
- Jun 2, 2024Feature/apply-fixes — mitin20/QodanaDemo1 reaction · 1 comment
- Aug 17, 2023Colima github action breaking — douglascamata/setup-docker-macos-action1 reaction · 10 comments
- Nov 4, 2022Updating the readme as wrongsecrets moved to OWASP orga! — psiinon/owasp-projects1 reaction
- Oct 26, 2026[Aikido] AI Fix for 3rd party Github Actions should be pinned — maxgaywood/wrongsecrets0 reactions · 1 comment
- Oct 25, 2026[Aikido] KAN-4566 AI Fix for 3rd party Github Actions should be pinned — Roland-s-Demo-Org/wrongsecrets0 reactions
- Oct 24, 2026[Aikido] KAN-4556 AI Fix for Docker container runs as default root user — Roland-s-Demo-Org/wrongsecrets0 reactions
- Oct 24, 2026[Aikido] KAN-4546 AI Fix for 3rd party Github Actions should be pinned — Roland-s-Demo-Org/wrongsecrets0 reactions
- Oct 23, 2026[Aikido] KAN-4515 AI Fix for AKS local admin account is still enabled — Roland-s-Demo-Org/wrongsecrets0 reactions
- Oct 23, 2026[Aikido] KAN-4510 AI Fix for Azure Storage Account allow public access — Roland-s-Demo-Org/wrongsecrets0 reactions
- Oct 23, 2026[Aikido] KAN-4508 AI Fix for Azure Key Vault allows public network access — Roland-s-Demo-Org/wrongsecrets0 reactions
- Oct 23, 2026[Aikido] KAN-4504 AI Fix for 3rd party Github Actions should be pinned — Roland-s-Demo-Org/wrongsecrets0 reactions
- Oct 22, 2026[Aikido] KAN-4466, KAN-4080 AI Fix for Automatic upgrades or base Docker images can lead to supply chain attacks — Roland-s-Demo-Org/wrongsecrets0 reactions
- Oct 22, 2026[Aikido] KAN-4465 AI Fix for 3rd party Github Actions should be pinned — Roland-s-Demo-Org/wrongsecrets0 reactions
- Oct 22, 2026[Aikido] KAN-4464 AI Fix for Azure Storage Account allow public access — Roland-s-Demo-Org/wrongsecrets0 reactions
- Oct 21, 2026[Aikido] KAN-4427 AI Fix for AKS local admin account is still enabled — Roland-s-Demo-Org/wrongsecrets0 reactions
- Oct 21, 2026[Aikido] KAN-4415 AI Fix for Azure Storage blobs do not restrict public access for nested items — Roland-s-Demo-Org/wrongsecrets0 reactions
- Oct 21, 2026[Aikido] KAN-4409 AI Fix for S3 Buckets should have block public access globally — Roland-s-Demo-Org/wrongsecrets0 reactions
- Oct 20, 2026[Aikido] AI Fix for 3rd party Github Actions should be pinned — JPeacock97/wrongsecrets0 reactions
- Oct 12, 2026[Aikido] KAN-4080, KAN-4327 AI Fix for Automatic upgrades or base Docker images can lead to supply chain attacks — Roland-s-Demo-Org/wrongsecrets0 reactions
- Oct 10, 2026[Aikido] AI Fix for 3rd party Github Actions should be pinned — Aikido-demo-Mohit/wrongsecrets0 reactions
- Oct 8, 2026[Aikido] KAN-4295 Fix critical issue in maven-shared-utils via minor version upgrade from 3.1.0 to 3.3.3 — Roland-s-Demo-Org/wrongsecrets0 reactions
- Oct 5, 2026[Aikido] KAN-4257 AI Fix for S3 Buckets should have block public access globally — Roland-s-Demo-Org/wrongsecrets0 reactions
- Oct 5, 2026Add AWS access keys to test-secret.txt — abhishek-ox/wrongsecrets0 reactions · 1 comment
- Sep 8, 2026[Aikido] Fix critical issue in netty-handler via minor version upgrade from 4.1.114 to 4.1.137 — Roland-s-Demo-Org/wrongsecrets0 reactions
- Sep 4, 2026[Aikido] Fix 1 critical issue in maven-compat, maven-core — Roland-s-Demo-Org/wrongsecrets0 reactions
- Aug 25, 2026[Aikido] AI Fix for S3 Buckets should have block public access globally — Roland-s-Demo-Org/wrongsecrets0 reactions
- May 20, 2026Add OWASP WrongSecrets — devsecops/awesome-devsecops0 reactions
- Jan 9, 2026Upgrade secret scanning review action to v2 — turbo/ws-test-10 reactions
- Jul 28, 2025Create test.txt — futurewhitehat/secret-scanning-poc-10 reactions · 1 comment
- Jul 28, 2025Clean slate — futurewhitehat/secret-scanning-poc-10 reactions
- Mar 19, 2025Create hard_secret — Dani-eci/wrongsecrets0 reactions
- Dec 5, 2024Boris test — wesco-test/wrongsecrets0 reactions
- Nov 21, 2024Implement Renovate — OWASP/wrongsecrets-ctf-party0 reactions
- Oct 7, 2024Rename challenge49docker-compose.yml to challenge51docker-compose.yml — Shubham-Patel07/wrongsecrets0 reactions
- Oct 7, 2024Challenge49 — Shubham-Patel07/wrongsecrets0 reactions
- Aug 12, 2024Update AboutController.java — RepoBipo/wrongsecrets0 reactions
- Aug 9, 2024Upgrade to the latest wrongsecrets (1.9.2) — OWASP/wrongsecrets-ctf-party0 reactions · 1 comment
- Sep 20, 2023Zeus feature branch — zeusCycode/wrongsecrets0 reactions
- Sep 7, 2023Experiment bed — rdejong1979/WEU-ADO-WrongSecrets0 reactions · 1 comment
- Aug 22, 2023Test with wrongsecrets — cdxgen/cdxgen0 reactions · 2 comments
- Jun 29, 2023Analysis of Repository 1 for Task One OWASP - Wrongsecrets Answering the following questions based on Task One *see description — ChakirBelhaj/software-engineering-processes-group-680 reactions
- May 23, 2023Implement challenge33 — OWASP/wrongsecrets-ctf-party0 reactions
- May 7, 2023Support for custom_metadata in `Versioned.Metadata` — spring-projects/spring-vault0 reactions · 5 comments
- Feb 25, 2023Upgrade to K8s version 1.25 — OWASP/wrongsecrets-ctf-party0 reactions
On Bluesky · 8
- May 2, 2025We released version 1.11.2 of #OWASP #WrongSecrets: it's faster than ever, has now 55 challenges and a lot of fun! Check it out at… — @commjoenie.bsky.social23 likes and reposts · 1 reply
- Apr 23, 2026We released 1.13.3 of #OWASP #WrongSecrets with 2 new #security challenges! Reverse engineer a #swift Binary and use the #hardcoded… — @commjoenie.bsky.social8 likes and reposts
- Mar 7, 2026We released version 1.13.1 of #OWASP #WrongSecrets! Now with #springboot4 and challenges involving #telegram #AI, #MCP . You can test it at… — @commjoenie.bsky.social7 likes and reposts
- Oct 6, 2026We reached challenge 75 at #OWASP #WrongSecrets ! See arcane-scrubland-42646.herokuapp.com for the first preview! I am super proud of all… — @commjoenie.bsky.social4 likes and reposts
- Mar 24, 2026We released a new version of #OWASP #WrongSecrets with a new #AI challenge: an authorization bypass using an #MCP service account! Want to… — @commjoenie.bsky.social3 likes and reposts · 1 reply
3 more on Bluesky
- Dec 7, 2023OWASP WrongSecrets A hands-on game packed with real-life examples of improper secrets management in software. Includes 41 challenges to… — @ndeepak.bsky.social2 likes and reposts
- Sep 9, 2026Loads of new #ai #challenges are coming to #OWASP #WrongSecrets. Want to see a preview? check arcane-scrubland-42646.herokuapp.com ! Like… — @commjoenie.bsky.social1 likes and repost
- Mar 30, 2024Welcome to the OWASP WrongSecrets game! — @netalexx.bsky.social1 likes and repost
On Hacker News · 1
- Dec 4, 2023How to Not Use Secrets6 points
On Stack Overflow · 1
- May 23, 2024How can I make static class members be accepted by eslint9?2 votes · 1 answer
In this repository2 other files it gives its agents.
- .devcontainer/AGENTS.mdAGENTS.md
- .github/copilot-instructions.mdCopilot instructions
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

