Leaked secrets interview questions

Question 1

This middleware was added to debug a production issue. What should a reviewer flag?

import logging

logger = logging.getLogger(__name__)

def log_request(request) -> None:
    logger.info("%s %s", request.method, request.path)
    logger.info("headers: %s", dict(request.headers))

Accepted Answer

Line 8: Request headers include `Authorization` bearer tokens, session cookies and API keys. Writing them to logs leaks live credentials to everyone with log access and to every log pipeline they pass through.

Question 2

This runs in the browser when the user clicks "Pay". What's the problem?

const STRIPE_SECRET_KEY = "sk_live_51Hx9EXAMPLEf3kL0rEmIpSuM";

export async function createCharge(amountCents, token) {
  const res = await fetch("https://api.stripe.com/v1/charges", {
    method: "POST",
    headers: { Authorization: `Bearer ${STRIPE_SECRET_KEY}` },
    body: new URLSearchParams({ amount: amountCents, currency: "usd", source: token }),
  });
  return res.json();
}

Accepted Answer

Line 1: Everything shipped to the browser is public. Anyone can read the live secret key from the bundle or the network tab and use it to issue refunds, read customers, or create charges. Secret keys belong on the server; the browser should call your own endpoint.

Question 3

This signs session tokens for the API. What should block this PR?

var jwtSecret = []byte("super-secret-change-me")

func SignToken(userID string) (string, error) {
	claims := jwt.MapClaims{
		"sub": userID,
		"exp": time.Now().Add(24 * time.Hour).Unix(),
	}
	return jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString(jwtSecret)
}

Accepted Answer

Line 1: The signing key is in source control. Anyone who can read the repo (or a leaked copy) can mint valid tokens for any user, including admins. Load it from a secret store or environment at startup, and fail if it's missing.

Leaked secrets: interview questions

How to spot it in code review

Why AI-generated code gets this wrong

Leaked secrets: 3 practice questions

Logging every request header

Secret key in front-end code

Hard-coded JWT signing key

Attempts distribution