Welcome to dagensbanan.se — where we peel back the layers of secrets management!
Just like a banana protects its delicious fruit, your secrets need proper protection too.
Fun twist: We've hidden fake secrets EVERYWHERE. Your mission? Find them all!
🔒 Click the lock to begin your journey
🤫 What Are Secrets (Besides Banana Recipes)?
In the world of software, "secrets" are sensitive pieces of information that grant access to systems, APIs, databases, and more. They're the keys to the banana kingdom! 🍌
API Keys
Tokens that authenticate your application with external services. Like a VIP pass to the banana plantation.
Database Passwords
Credentials that grant access to your data stores. The combination to the banana vault!
TLS/SSL Certificates
Digital certificates that prove identity and enable encryption. The banana's peel of protection.
SSH Keys
Key pairs used for secure shell access to servers. Your banana-shaped key to the server room.
OAuth Tokens
Tokens that allow applications to act on behalf of users. A banana-flavored permission slip.
Connection Strings
URLs containing credentials for database connections. The banana bunch that connects everything.
💎 The Fake Secrets Treasure Trove
Below are ALL the fake secrets we've hidden across the environment variables and file system. Hover over each card to reveal the secret. Click to mark it as "collected." Remember: These are all intentionally fake! 🍌
Found: 0 / 0 secrets collected
🗺️ Where We Hid the Bananas... err, Secrets
$ env | grep -i secret
DB_PASSWORD=BananaSplit_S3cret!2024
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYBANANAKEY
API_KEY=sk-banana-proj-fake1234567890abcdef
STRIPE_SECRET_KEY=sk_live_BananaPayments_NotReal_42069
JWT_SECRET=super-secret-banana-jwt-signing-key-2024
GITHUB_TOKEN=ghp_BananaToken1234567890FakeNotReal
SLACK_WEBHOOK=https://hooks.slack.com/services/BANANA/FAKE/NotARealWebhook
SENDGRID_API_KEY=SG.BananaMailer.FakeKeyForEducation2024
# 🍌 File System Secrets — Hidden in plain sight!
$ find / -name "*.secret" -o -name "*.key" -o -name ".env" 2>/dev/null
/etc/banana-secrets/.env
/opt/app/config/database.secret
/home/banana/.ssh/id_rsa_banana
/var/run/secrets/banana-vault/api-token
/tmp/.banana-backdoor-key
$ cat /etc/banana-secrets/.env
MONGO_URI=mongodb://bananaAdmin:Yell0wFru1t!@fake-mongo.dagensbanan.se:27017/bananas
REDIS_PASSWORD=banana-redis-cache-fake-pass-42
ENCRYPTION_KEY=aes-256-cbc-banana-encryption-key-not-real
$ cat /home/banana/.ssh/id_rsa_banana
-----BEGIN RSA PRIVATE KEY-----
BANANA+FAKE+KEY+DO+NOT+USE+THIS+IS+EDUCATIONAL
MIIEpAIBAAKCAQEA0Banana1Fake2Key3Here4For5
Education6Purposes7Only8Please9Dont0Use1Real
Keys2In3Your4Code5Ever6Thank7You8Banana9Peel
-----END RSA PRIVATE KEY-----
$ cat /var/run/secrets/banana-vault/api-token
hvs.BANANA-VAULT-TOKEN-FAKE-2024-DO-NOT-USE
$ cat /tmp/.banana-backdoor-key
BACKDOOR_KEY=just-kidding-this-is-a-lesson-about-not-leaving-secrets-in-tmp
🍌 All secrets above are 100% FAKE — planted for education! 🍌
🔍 Interactive Banana Secret Hunt!
Click the tiles below to search for hidden banana secrets! Some tiles contain secrets, others contain... surprises. Find all 8 bananas! 🍌
📚 The Banana Guide to Secrets Management
✅ DO — The Ripe Banana Practices
Use a Secrets Manager
Tools like HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, or GCP Secret Manager. Keep your bananas in a proper vault!
Rotate Secrets Regularly
Change your secrets periodically, like rotating your banana stock. Fresh secrets = fresh security!
Audit Access Logs
Monitor who accesses your secrets and when. Know who's peeling your bananas!
Encrypt at Rest & Transit
Always encrypt secrets when stored and when transmitted. Double-wrap your banana!
Use .gitignore
Always add .env files and secret configs to .gitignore. Don't commit your banana peels to git!
Principle of Least Privilege
Give each service only the secrets it needs. Not every monkey needs the whole banana bunch!
❌ DON'T — The Rotten Banana Practices
Hardcode Secrets in Source Code
Never embed secrets directly in your code. That's like writing your PIN on your banana!
Commit Secrets to Git
Once in git history, secrets are nearly impossible to fully remove. The banana stain never comes out!
Log Secrets
Don't print secrets in logs, console output, or error messages. Don't announce your banana hiding spot!
Share via Chat/Email
Don't send secrets through Slack, Teams, or email. Those bananas leave a trail!
Store in /tmp or World-Readable Files
Temporary directories are not secret vaults. Anyone can find bananas left on the counter!
Reuse Secrets Across Services
One compromised secret shouldn't compromise everything. Don't put all bananas in one bunch!
🌍 Real-World Banana Peels (Common Mistakes)
services:
database:
environment:
MYSQL_ROOT_PASSWORD: BananaRoot123! <-- NEVER DO THIS
# 🍌 Mistake #2: Secrets in frontend JavaScript
const config = {
apiKey: "sk-live-BananaPayments123", <-- VISIBLE TO EVERYONE
};
# 🍌 Mistake #3: Secrets in CI/CD pipeline logs
echo "Deploying with key: $SECRET_KEY" <-- LOGGED IN PLAIN TEXT
# 🍌 Mistake #4: .env file committed to public repo
$ git log --all --oneline -- .env
a1b2c3d Added .env with all production secrets 🤦
f4e5d6c Oops, removed .env (but it's still in git history!)
# 🍌 Mistake #5: Secrets in Kubernetes manifests
apiVersion: v1
kind: ConfigMap <-- Should be Secret (base64 encoded at minimum!)
data:
db-password: "SuperSecretBanana!" <-- In plain text in etcd
🍌 Learn from these mistakes — don't be the one who slips on the banana peel!
🛠️ Tools for Banana-Grade Security
$ trufflehog git https://github.com/your-repo # Sniffs out secrets in git history
$ gitleaks detect --source . # Fast secret scanner
$ detect-secrets scan # Yelp's secret detection tool
# 🏦 Secret Management Solutions
→ HashiCorp Vault # Industry standard, self-hosted
→ AWS Secrets Manager # Native AWS integration
→ Azure Key Vault # Microsoft's offering
→ GCP Secret Manager # Google Cloud native
→ Doppler # Developer-friendly SaaS
→ 1Password Secrets Automation # From passwords to secrets
→ SOPS (Secrets OPerationS) # Mozilla's encrypted file editor
# 🔒 Pre-commit Hooks (Prevent secrets from being committed)
$ pre-commit install
pre-commit installed at .git/hooks/pre-commit
✓ Now secrets will be blocked before they reach git! 🍌
📮 Post Your Collected Secrets!
You've hunted, you've gathered, now it's time to submit! Click the button below to POST all
collected fake secrets to /secrets on dagensbanan.se.
This demonstrates how a real secrets collection/rotation workflow might work! 🍌
📦 Collected Secrets Payload:
🥚 Easter Eggs & Hidden Messages
Good security researchers always look deeper. Here are some things to investigate on this page:
- 🔍 Check the HTML source code comments for secrets
- 🔍 Inspect the CSS comments — we hid credentials there too!
- 🔍 Look at the JavaScript console — something's been logged
- 🔍 Try the Konami Code↑ ↑ ↓ ↓ ← → ← → B A for a special surprise
- 🔍 Select/highlight this text: BANANA_MASTER_KEY=Y3ll0w-Fru1t-S3cr3t-2024!
- 🔍 Right-click → Inspect → Application → Check for cookies 🍪
- 🔍 Look in the page's
localStorage— we planted something there! - 🔍 Check the page title closely 👀
- 🔍 There's a hidden div with display:none containing HIDDEN_DIV_SECRET=banana-inception-2024
For all your secrets management emergencies, please call:
_
//\
// \\ Ring ring ring ring ring ring ring...
// \\ 🍌 BANANA PHONE! 🍌
// \\
|| ___ || ┌─────────────────────────────────┐
|| | | || │ DIAL 1-800-BAN-ANAS │
|| | | || │ Press 1 for: Secret Rotation │
|| | | || │ Press 2 for: Vault Setup │
|| | | || │ Press 3 for: Emergency Leak │
|| | | || │ Press 4 for: Banana Recipes │
|| |___| || │ Press 🍌 for: Existential Dread │
|| || └─────────────────────────────────┘
|| === ||
\\ //
\\ // "I've got this feeling, it's so appealing
\\ // for us to get together and ENCRYPT!"
\//
V
AGENT-🍌-000000🎹 The Banana Piano 🎹
Click the bananas to play music! Each banana is a different note.
You can also use keys 1-8 on your keyboard! 🎵
🤓 Random Banana × Security Fact
Bananas are naturally radioactive due to potassium-40. Similarly, every codebase naturally contains at least one hardcoded secret — both are concerning at scale! 🍌☢️