Unit 03 of 03
Secrets in Code
The coverage measure for the key, generator, and dependency items the code relies on: how many of the cryptography call points pass through the central layer, the concrete consequence of reusing the same starting value and of having no integrity tag, how much a weak generator gives away in advance once the seed is known, how many commits a secret stays exposed in a fictional repository's history and what history cleanup does not rescue, the portion of the leaked items in error messages and log lines that the central masking layer closes versus leaves exposed, and the transitive depth in the dependency graph along with the number of packages a single component affects.
Published Updated
Lessons
- 01 Cryptographic Misuse The coverage of cryptography call points and the concrete consequence of misuse: how seven of fourteen call points stay uncovered by the central layer, how reusing the same key and the same starting value makes forty positions readable, how the format check in encryption without an integrity tag misses four of twenty-four changes, and how a new call point is covered automatically once the primitive call is confined to a single file. 9 min read
- 02 Randomness A same-scale comparison of the weak generator and the cryptographically secure generator: when the seed is known, all ten thousand values can be precomputed; out of ten thousand four-digit codes, only 903 come out distinct; mapping a byte to a digit by remainder produces a 1.04 bias; and six of the nine token-generation points call the weak generator. 14 min read
- 03 Hardcoded Secrets The number of commits a secret stays exposed in a fictional repository history, and what pattern scanning covers: five secrets appear in 124 commits in the working tree and 223 commits in history, history cleanup fails to reach eighteen of nineteen copies, snapshot scanning sees only one of the five secrets, and the same rule produces a 76.8x increase in findings with a 0.69 false-positive rate over history. 13 min read
- 04 Error Messages and Log Leakage Counting the leakage in an error response and a log line as items: eight endpoints carrying forty item-response pairs in direct mode, the central error handler covering six endpoints and leaving two outside, a top-level name list closing three of eleven log items, the same list run at every level closing eight, format-based masking closing nine, and two items in free text and a query string closing under no list. 13 min read
- 05 Dependency-Related Risks The dependency graph's coverage measure: eight names appear in the manifest file while thirty-four packages exist in the process, the transitive depth rising to six, a single component affecting twenty packages, three of eight direct dependencies never being called, and four of six open findings arriving with the same severity being in reachable components and two being in an unreached component. 13 min read