Secure › Module 5 › Lesson 3
Never Plaintext
Secrets, tokens, and passwords never stored raw — vault habits in YOUR repo only.
Visual · never_plaintext
No plaintext secrets literacy. $MY_REPO only. Original Cyberlium.
Opening
If it is a password or API key, plaintext on disk is a incident waiting — fix YOUR config, not stranger databases.
Never plaintext means: no password columns, no API keys in git history, no session secrets in client JS, no.env committed to public repo. Use environment variables, secret managers, and hashed passwords in $MY_REPO. Cyberlium teaches grep for secrets and rotate lab keys — not downloading stranger.env leaks or phishing OAuth tokens from classmates. You will NOT build phishing OAuth kits or harvest tokens from live shops. Next: Auth Storage Lab.
1. Passwords, keys, tokens — three never-plaintext classes
Passwords: hash with bcrypt/Argon2 only. API keys: env var or vault, never commit. Session tokens: httpOnly secure cookies server-side, not localStorage for sensitive sessions in production patterns.
Grep $MY_REPO for password=, api_key=, BEGIN PRIVATE KEY — redact and rotate lab fakes.
Command guide
Try these commands — Passwords, keys, tokens — three never-plaintext classes
═══ LINUX / BASH (Network & Reconnaissance Audit) ═══
Scan target host for open ports and service version signatures
Command — copy this
nmap -sS -sV -p 80,443,8080 -Pn ${LAB_HOST:-127.0.0.1}DNS and WHOIS reconnaissance on authorized domain
Command — copy this
dig +short A target.local dig +short MX target.local whois target.local 2>/dev/null | grep -iE "(Registrar|Creation Date|Name Server)" | head -6
Inspect HTTP headers for technology stack fingerprinting
Command — copy this
curl -s -I "http://${LAB_HOST:-127.0.0.1}:8080" | grep -iE "(Server|X-Powered-By|Set-Cookie|Content-Security-Policy)"Primary tools to practice this lesson: grep, python3. Reference sites: CWE-256 plaintext (https://cwe.mitre.org/data/definitions/256.html); Password storage (https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Git history remembers
Deleting a secret in latest commit is not enough — history may retain it. Lab: use git-secrets literacy or manual audit; rotate any test key that touched a branch.
Publishing classmate leaked.env in chat is harm — not secure-coding practice.
3. No OAuth phish kits
OAuth literacy comes in Module 6 — not fake login pages aimed at strangers or classmates. This lesson is storage hygiene on $MY_REPO only.
Ship: grep audit note + one rotation action. Next: Auth Storage Lab.
4. What you ship: plaintext audit for $MY_REPO
Grep results redacted. Lab secrets in env not git. No OAuth phish. chmod 600.
5. What you record before the next lesson
Date. Plaintext audit summary. Rotation if needed. File t17-m05-l03-never-plaintext.txt chmod 600.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Commit real API key to public $MY_REPO. Share classmate.env in Discord. Build OAuth phish page.
Right
Audit and redact plaintext secrets in $MY_REPO. Next: Auth Storage Lab.
Mission: plaintext secret audit
1) Grep $MY_REPO for key/password patterns. 2) Move lab secrets to.env (gitignored). 3) Rotate any exposed test key. Never publish stranger secrets.
Stuck? Ask Cyberlium AI Mentor
.env.example with placeholders — never.env with real keys in git.
Knowledge Check
APPLY: Never plaintext in Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: HTTPS alone makes plaintext password storage acceptable.
True or False
Knowledge Check
APPLY: OAuth phish kits targeting classmates:
Multiple choice