wrongsecrets
Vulnerable app with examples showing how to not use secrets
What XERJ indexed
Selected work
“Add Challenge 73: Expose Secret in Agent Instruction Files”. 6 files, 195 lines in src/test, src/main, the project root.
Licence
The repository
Checked by a person at the pinned commit.
The XERJ corpus
The author agreed by email on 2026-10-20. Agents read it for how it works, not to copy it. Answers name the repo, the commit and the file:line.
in licence reviewnot in the hub yetsuggested use: approach only
hashicorp-vaultjavakubernetessecretssecrets-managementdevsecopssecurityaws
Example questions
- How does wrongsecrets implement hashicorp-vault?
- Where does wrongsecrets handle “Add Challenge 73: Expose Secret in Agent Instruction Files”?
- What does src/test do in wrongsecrets?
The prompt
Paste it into your AI agent. It clones OWASP/wrongsecrets at the pinned commit and indexes it on your machine.
Search the GitHub repository OWASP/wrongsecrets with XERJ (https://hub.xerj.org/corpus/owasp--wrongsecrets). Run these in a shell, in order, and check each result before the next: 1. xerj --help (success: it prints usage). If xerj is missing: curl -fsSL https://xerj.org/get | sh 2. git clone https://github.com/OWASP/wrongsecrets wrongsecrets && git -C wrongsecrets checkout bcc5724e7ddcc7aa641103e8451e38fcf09f4fde 3. Start a local node and leave it running: xerj --insecure --data-dir ./xerj-data 4. xerj autoindex ./wrongsecrets --url http://127.0.0.1:9200 --prefix wrongsecrets --progress plain 5. xerj autoindex map --url http://127.0.0.1:9200 Then answer my question from the indexed files and cite the ax_path of every hit. Query syntax: https://xerj.org/llms.txt Licence: AGPL-3.0. Read it for the approach only, do not copy code.
Related
Anirban GhoshSecurity and vulnerabilities corporakeywhizchambercheckovVampsecure-Labs/vamp-k8s-auditargus-code-scanning/argus-codescan-mcpselan-ai/whatileaked
Selected work and consent: the XERJ registry.