The key in the source code
A easy Java puzzle in the security mistakes family. One line below contains a real bug. Try to spot it first, then read why it fails and how to fix it.
Highlighted: line 2. Play this one as a puzzle without the answer.
What is wrong
A secret committed to source control is visible to everyone with repository access, remains in the history after deletion, and ends up in build artifacts and decompiled jars. The key must be considered compromised.
The fix
How to avoid it next time
Load secrets from the environment or a secrets manager, rotate any key that was committed, and add secret scanning to CI.
Want the background? Read Cloud credentials and secrets management in the Java concepts library.
About security mistakes
Predictable random numbers, secrets in source code, unvalidated file paths and weak hashes turn working features into vulnerabilities. They pass every functional test.
In code review: Search for java.util.Random in security contexts, literals that look like keys, paths built from user input, and MD5 or SHA-1 used for passwords.
More puzzles in this family
Frequently asked questions
What is the bug in "The key in the source code"?
A secret committed to source control is visible to everyone with repository access, remains in the history after deletion, and ends up in build artifacts and decompiled jars. The key must be considered compromised. The faulty line is line 2: private static final String API_KEY = "sk_live_EXAMPLE_do_not_use_1234567890";
How do I fix it?
Replace it with: private final String apiKey = System.getenv("PAYMENT_API_KEY"); // or a secrets manager. Load secrets from the environment or a secrets manager, rotate any key that was committed, and add secret scanning to CI.
How do I catch security mistakes in code review?
Search for java.util.Random in security contexts, literals that look like keys, paths built from user input, and MD5 or SHA-1 used for passwords.
Is there a new puzzle every day?
Yes. The daily Spot the Bug puzzle picks one of these snippets for each UTC day, with the difficulty set by the weekday. Your streak is stored only in your browser.