---

## Example Secret for Challenge 56

To solve challenge 56, find the following secret in this file:

**secret-challenge-56: S3cr3tInPr0j3ctSp3c**

Use this value as the answer for challenge 56.

---

package org.owasp.wrongsecrets.challenges.docker;

import static org.owasp.wrongsecrets.Challenges.ErrorResponses.FILE_MOUNT_ERROR;

import com.google.common.base.Strings;

import java.nio.charset.StandardCharsets;

import java.nio.file.Files;

import java.nio.file.Path;

import java.nio.file.Paths;

import lombok.extern.slf4j.Slf4j;

import org.owasp.wrongsecrets.challenges.Challenge;

import org.owasp.wrongsecrets.challenges.Spoiler;

import org.springframework.beans.factory.annotation.Value;

import org.springframework.stereotype.Component;

public class Challenge56 implements Challenge {

private final String projectSpecPath;

private String actualSecret;

public Challenge56(

@Value("${projectspecpath:cursor/rules/project-specification.mdc}") String projectSpecPath) {

this.projectSpecPath = projectSpecPath;

}

@Override

public Spoiler spoiler() {

return new Spoiler(getActualSecret());

}

@Override

public boolean answerCorrect(String answer) {

return !Strings.isNullOrEmpty(answer) && getActualSecret().equals(answer.trim());

}

private String getActualSecret() {

if (Strings.isNullOrEmpty(actualSecret)) {

try {

Path filePath = Paths.get(projectSpecPath);

String content = Files.readString(filePath, StandardCharsets.UTF_8);

// Look for the line with the secret

for (String line : content.split("\n")) {

if (line.trim().startsWith("**secret-challenge-56:")) {

actualSecret = line.split(":", 2)[1].trim();

break;

}

}

if (Strings.isNullOrEmpty(actualSecret)) {

return FILE_MOUNT_ERROR;

}

} catch (Exception e) {

log.warn("Exception during file reading for Challenge56", e);

return FILE_MOUNT_ERROR;

}

}

return actualSecret;

}

}

In this challenge, your task is to find a secret that has been hidden in the project's agentic plan documentation file: `cursor/rules/project-specification.mdc`.

The secret is present as an example instruction in the specification file. Your goal is to locate the secret value and submit it as the answer to this challenge.

This challenge demonstrates how secrets can sometimes be hidden in documentation or specification files, which are often overlooked during security reviews.

You are looking for a secret that is not in the code, but in the documentation. Check the agentic plan in `cursor/rules/project-specification.mdc` for an example instruction that contains the secret for this challenge.

Documentation and specification files are often shared widely and may be overlooked during security reviews. Sometimes, secrets or sensitive information are added as examples or instructions and are not removed before sharing or publishing. This challenge highlights the importance of reviewing all project files—including documentation—for secrets and sensitive data.

package org.owasp.wrongsecrets.challenges.docker;

import static org.assertj.core.api.Assertions.assertThat;

import java.io.File;

import java.io.IOException;

import java.nio.file.Files;

import java.nio.file.Path;

import org.junit.jupiter.api.Test;

import org.junit.jupiter.api.io.TempDir;

import org.owasp.wrongsecrets.Challenges;

import org.owasp.wrongsecrets.challenges.Spoiler;

class Challenge56Test {

@Test

void solveChallenge56WithoutFile(@TempDir Path dir) {

var challenge = new Challenge56(dir.resolve("nonexistent.mdc").toString());

assertThat(challenge.answerCorrect("S3cr3tInPr0j3ctSp3c")).isFalse();

assertThat(challenge.answerCorrect(Challenges.ErrorResponses.FILE_MOUNT_ERROR)).isTrue();

}

@Test

void solveChallenge56WithFile(@TempDir Path dir) throws Exception {

var testFile = new File(dir.toFile(), "project-specification.mdc");

var secretLine = "**secret-challenge-56: S3cr3tInPr0j3ctSp3c";

Files.writeString(testFile.toPath(), "Some intro text\n" + secretLine + "\nSome outro text\n");

var challenge = new Challenge56(testFile.getAbsolutePath());

assertThat(challenge.answerCorrect("S3cr3tInPr0j3ctSp3c")).isTrue();

assertThat(challenge.answerCorrect("wrongsecret")).isFalse();

}

@Test

void spoilShouldReturnCorrectAnswer(@TempDir Path dir) throws IOException {

var testFile = new File(dir.toFile(), "project-specification.mdc");

var secretLine = "**secret-challenge-56: S3cr3tInPr0j3ctSp3c";

Files.writeString(testFile.toPath(), secretLine + "\n");

var challenge = new Challenge56(testFile.getAbsolutePath());

assertThat(challenge.spoiler()).isEqualTo(new Spoiler("S3cr3tInPr0j3ctSp3c"));

}

}