OWASP WrongSecrets: How We Keep on Growing Our Open Source Project
summary
An open source vulnerable app called WrongSecrets lists 46–47 challenges that reproduce real secret‑storage mistakes and runs in a Docker container on Heroku or Kubernetes while provisioning Vault and Terraform when needed. CI enforces quality with GitHub Actions, pre-commit hooks, Cypress end‑to‑end tests and Dependabot, automated builds and scans (container build, nightly dependency PRs). The project attracts volunteers who submit focused PRs, automation keeps the site runnable, and the CTF/hosting pieces work in practice.
AI-written summary · about
chapters (16)
- 0:00OWASP WrongSecrets intro
- 1:52Starting open source journey
- 4:18Why WrongSecrets created
- 9:02Reasons to start OSS
- 12:55Collaborating in open source
- 16:02Achievable contributions
- 18:10Automated testing & deps
- 22:07Building without users
- 24:34Consistency and maintainability in open source
- 27:07Promoting OSS work
- 29:57Handling feedback kindly
- 34:11Being a good maintainer
- 37:00Free credits & solutions
- 39:06OWASP Foundation benefits
- 40:52Lessons learned in open source development
- 41:36Q&A
related talks
44mOpen Source Security: The World Needs Our Help
43mApplication Security is a Community Effort
53mWhere The Wild Things Are: The State Of Open Source Supply Chain Risk Management In Three Stories
47mUnder the Radar: How we found 0-days in the Build Pipeline of OSS Packages
52mCollaborating to Improve Open Source Security: How the Ecosystem Is Stepping Up
49mTrustworthy Open Source: The Consequences of Success
27mBuilding a Secure Open Source Project on GitHub
44mSecurity Research with Open Source Software: Vol. Omega