================================================================================
SIMULATED GIT HISTORY — FOR CTF / EDUCATIONAL USE ONLY
All secrets, commits, and authors are completely fictional.
================================================================================

$ git log --all --oneline --graph

* f4a8e21 (HEAD -> main) Update README with deployment docs
* c3b7d10 Add rate limiting middleware
* a2f6c09 Fix login redirect bug
* 91e5b08 oops remove secrets
* 80d4a07 Remove API key that was accidentally committed
* 7fc3906 remove credentials file
* 6eb2805 delete private key — should not have been committed
* 5da1704 Add payment processing module
* 4c90603 Initial project setup with authentication
* 3b8f502 first commit — project scaffold


$ git log --diff-filter=D --name-only --pretty=format:"%h %ai %an — %s" -- "*.env" "*.pem" "*.key" "*credentials*" "*secret*" "*id_rsa*"

91e5b08 2026-03-15 09:42:31 -0400 Jamie Chen — oops remove secrets
.env
.env.production
config/secrets.yml

80d4a07 2026-03-14 16:28:55 -0400 Jamie Chen — Remove API key that was accidentally committed
src/services/google_maps_key.txt

7fc3906 2026-03-14 11:15:22 -0400 Alex Rivera — remove credentials file
config/credentials.json

6eb2805 2026-03-13 22:07:18 -0400 Jamie Chen — delete private key — should not have been committed
config/ssl/id_rsa
config/ssl/id_rsa.pub


$ git show 4c90603:.env

# Application Environment — DO NOT COMMIT
APP_SECRET_KEY=fake-django-secret-k3y-xq9#mz!v7w2p$8t6u1r0
DATABASE_URL=postgresql://portal_user:F4k3DbP@ssw0rd!@db.example.internal:5432/portal_prod
REDIS_URL=redis://:r3d1s_s3cr3t@redis.example.internal:6379/0
GOOGLE_MAPS_API_KEY=AIzaSyFAKE-API-KEY-1234567890abcdefghijk
STRIPE_SECRET_KEY=sk_live_FAKE51HG3xK3y000000000000000000000000000
MAILGUN_API_KEY=key-FAKE1234567890abcdef1234567890ab
SENTRY_DSN=https://fake1234567890@o000000.ingest.sentry.io/0000000


$ git show 4c90603:.env.production

# Production overrides
DATABASE_URL=postgresql://prod_admin:Pr0d_P@ss_2026!Str0ng@prod-primary.c7xyz.us-east-1.rds.amazonaws.com:5432/portal_production
REDIS_URL=redis://:pr0d_r3d1s_2026!@prod-cache.abc123.use1.cache.amazonaws.com:6379/0
AWS_ACCESS_KEY_ID=AKIAIOSFODNN7FAKE002
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYFAKESECRET02
S3_BUCKET=acmecorp-portal-prod-assets


$ git show 4c90603:config/secrets.yml

production:
  secret_key_base: 3f4a8e21c3b7d10a2f6c0991e5b0880d4a077fc39066eb28055da17044c906033b
  jwt_signing_key: fake-rsa-jwt-signing-key-base64-encoded-content-here-000000000
  encryption_key: 0123456789abcdef0123456789abcdef
  oauth:
    github_client_secret: ghs_FAKE1234567890abcdefghijklmnopqrstuv
    google_client_secret: GOCSPX-FakeGoogleClientSecret1234567


$ git show 4c90603:config/credentials.json

{
  "type": "service_account",
  "project_id": "acmecorp-portal-prod",
  "private_key_id": "fake1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f",
  "private_key": "-----BEGIN RSA PRIVATE KEY-----\nFAKEKEYCONTENTTHATISNOTREALANDSHOULDNOTBEUSED000000000000\nTHISISCOMPLETELYFICTIONALFOREDUCATIONALPURPOSESONLY00000000\nNOTAREALPRIVATEKEYNOTAREALPRIVATEKEYNOTAREALPRIVATEKEY0000\n-----END RSA PRIVATE KEY-----\n",
  "client_email": "portal-svc@acmecorp-portal-prod.iam.gserviceaccount.com",
  "client_id": "000000000000000000000",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token"
}


$ git show 6eb2805^:config/ssl/id_rsa

-----BEGIN OPENSSH PRIVATE KEY-----
FAKEOPENSSHPRIVATEKEYTHATISNOTREALATALLDONOTUSE0000000000000000
EDUCATIONALPURPOSESONLYEDUCATIONALPURPOSESONLYEDUCATIONAL000000
THISISNOTAREALKEYDONOTATTEMPTOUSEITANYWHERE00000000000000000000
FAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKE00000000000000
-----END OPENSSH PRIVATE KEY-----


$ git show 80d4a07^:src/services/google_maps_key.txt

AIzaSyFAKE-API-KEY-1234567890abcdefghijk


$ git log --format="%h %ai %an — %s" --all

f4a8e21 2026-03-18 10:30:00 -0400 Alex Rivera — Update README with deployment docs
c3b7d10 2026-03-17 16:45:22 -0400 Alex Rivera — Add rate limiting middleware
a2f6c09 2026-03-16 14:20:11 -0400 Jamie Chen — Fix login redirect bug
91e5b08 2026-03-15 09:42:31 -0400 Jamie Chen — oops remove secrets
80d4a07 2026-03-14 16:28:55 -0400 Jamie Chen — Remove API key that was accidentally committed
7fc3906 2026-03-14 11:15:22 -0400 Alex Rivera — remove credentials file
6eb2805 2026-03-13 22:07:18 -0400 Jamie Chen — delete private key — should not have been committed
5da1704 2026-03-13 15:30:44 -0400 Alex Rivera — Add payment processing module
4c90603 2026-03-12 09:15:33 -0400 Jamie Chen — Initial project setup with authentication
3b8f502 2026-03-11 17:00:00 -0400 Jamie Chen — first commit — project scaffold


================================================================================
CHALLENGE:

1. How many distinct secrets are still recoverable from git history even
   though the files were "deleted"? List each one with its type and the
   commit where it can be found.

2. What git commands would an attacker use to extract these secrets?

3. What remediation steps should the team take? Consider:
   - Immediate credential rotation
   - History rewriting (BFG Repo Cleaner or git filter-repo)
   - Prevention (pre-commit hooks, .gitignore)

Expected findings: 18+ recoverable secrets across the deleted files.
================================================================================