The PR Build That Held A Production Key Debugging Lab

The PR Build That Held A Production KeyCI/CD & PipelinesMediumPreparing workspaceAutosaved

00:00

Incident Dossier

The PR Build That Held A Production Key

A deploy step reads a credential from the build environment and uses it to publish a release. The credential is configured in CI for protected branches; PR builds from forks, by policy, are not supposed to see it. The deploy step never complains about a missing key, even on PR builds that should not have access — so somewhere up the chain a fork PR's build has been quietly carrying the production key. The branch helper exists; the resolver never calls it.

Initial failing signalgetDeploySecret returns the secret for an untrusted branchExpected getDeploySecret(env, 'pr/123') throws · received getDeploySecret(env, 'pr/123') returns the secret

Progress

1Reproduce the bugRun checks

2Edit the fixOpen

3Pass checksOpen

4Submit fixOpen

Reproduction Steps

Run npm test.
Look at src/secrets.js. There's a helper that knows which branches are protected.
Read getDeploySecret. Does it consult the helper before handing back the secret?
Add the gate so untrusted branches throw before the secret can leave the resolver.

Focus Mode

Start

src/secrets.js

Likely area

src/secrets.js

Progressive hints

Hints reveal broad direction first, then narrow toward the suspect path without showing hidden tests or exact solution code.

TopicCI/CD & Pipelines

DifficultyMedium

Est. time20 min

Workspacecreating

Explorer

Preparing workspace files…

Evidence Map

Failing signal loaded from challenge API
Workspace files loaded from workspace API
Results rendered only after API run/submit

Autosaved

workspace

Outputread-onlyready$ workspace boot

Workspace booting...