Anirban Ghosh
Anirban Ghosh's work was selected for the XERJ Corpus Hub, the open reference memory AI coding agents search before they write code. When an agent meets the same problem, it gets this implementation back as a worked example, with the author and the repository attached.
Totals across every corpus @kekubhai appears in; a commit selected for two corpora counts once. Files and lines count the selected commits; each corpus indexes the whole repository at its pinned commit.
What an agent can do with the wrongsecrets corpus
OWASP/wrongsecrets: Vulnerable app with examples showing how to not use secrets
- Look up how wrongsecrets implements hashicorp-vault, java, kubernetes, with answers cited to file and line.
- Reuse a worked example: the commit “Add Challenge 73: Expose Secret in Agent Instruction Files” (6 files · Java).
- Answer from wrongsecrets's real Java source instead of memory (Security and vulnerabilities).
- Where does wrongsecrets handle “Add Challenge 73: Expose Secret in Agent Instruction Files”?
- How does wrongsecrets implement hashicorp-vault?
- What does src/test do in wrongsecrets?
Search the GitHub repository OWASP/wrongsecrets with XERJ (https://hub.xerj.org/corpus/owasp--wrongsecrets). Run these in a shell, in order, and check each result before the next: 1. xerj --help (success: it prints usage). If xerj is missing: curl -fsSL https://xerj.org/get | sh 2. git clone https://github.com/OWASP/wrongsecrets wrongsecrets && git -C wrongsecrets checkout bcc5724e7ddcc7aa641103e8451e38fcf09f4fde 3. Start a local node and leave it running: xerj --insecure --data-dir ./xerj-data 4. xerj autoindex ./wrongsecrets --url http://127.0.0.1:9200 --prefix wrongsecrets --progress plain 5. xerj autoindex map --url http://127.0.0.1:9200 Then answer my question from the indexed files and cite the ax_path of every hit. Query syntax: https://xerj.org/llms.txt Licence: AGPL-3.0. Read it for the approach only, do not copy code.
corpus owasp--wrongsecrets · Security and vulnerabilities
Related corpora: keywhiz, kics, Vampsecure-Labs/vamp-k8s-audit, argus-code-scanning/argus-codescan-mcp
Code security audit with XERJ · Case study: reference coding for agents
Selected work
OWASP/wrongsecrets
The corpus is the whole repository at the pinned commit, not only the files of the selected commit.
Not installable yet: this corpus is not in the hub registry until its licence review passes, so xerj corpus add and xerj ask cannot fetch it. It becomes installable when this card says live in the hub.
Sign in with GitHub or Hugging Face to see more: every selected commit in full (commit date, every folder, licence review state, pin) and the pack builds of each corpus.
[](https://hub.xerj.org/contributors/kekubhai)
Included with the author's permission (email, 2026-10-20), under each repository's own licence, with attribution. Want it removed? Reply to the email or open an issue on xerj-org/xerj.