Free
Free
Project page states WrongSecrets is free software under the AGPLv3 license with open GitHub resources
- Access
- Project page states WrongSecrets is free software under the AGPLv3 license with open GitHub resources
OWASP WrongSecrets
● Identity checkedCode · Vendor site 2026-10-04
OWASP WrongSecrets is a secrets-management-focused vulnerable application and CTF platform with Docker and cloud demo environments. Players hunt for more than 50 misconfigured or leaked secrets across Java, Docker, and Terraform examples to learn secure secrets handling and detection tooling.
- Category
- Code
- Free access
- Project page states WrongSecrets is free software under the AGPLv3 license with open GitHub resources
- API access
- Not confirmed
Is OWASP WrongSecrets right for you?
A good fit for
DevSecOps teams, trainers, and tool vendors evaluating secret detection against realistic misconfiguration scenarios.
Before you choose
Demo Heroku environments and local Docker runs expose intentionally weak secrets and must stay in controlled lab settings.
Secrets misconfiguration lab
OWASP WrongSecrets teaches secure secrets management by challenging players to find realistic leaks across cloud and container setups.
What it can do
Features & capabilities
Unknown is different from unavailable. Each fact carries its own evidence.
| Capability | Value | Evidence | Checked |
|---|---|---|---|
| Secrets focus | Description calls WrongSecrets the first secrets-management-focused vulnerable application with 50+ exercises. | Facts sourced | 2026-10-04 |
| Multi-environment play | Page lists local Docker, online demos, and cloud deployment options for CTF use. | Facts sourced | 2026-10-04 |
Understand the total cost
OWASP WrongSecrets pricing & plans
Alternatives to OWASP WrongSecrets
View all ↗
Aikido SecurityAikido Security is a developer-first application security platform covering dependencies, SAST, secrets, cloud misconfigurations, containers, and AI-assisted autofix across the SDLC. Pricing tiers scale from a free Developer workspace to paid Basic, Pro, and Advanced plans for larger repos and infrastructure coverage.
Explore tool
CosineCosine, hosted at cosine.sh, is a sovereign AI lab training specialized coding agents and models for secure environments. It offers Lumen Scout, Outpost, and Sovereign models plus CLI and cloud surfaces with transparent credit-based plans for developers and regulated teams.
Explore tool
Trae (formerly MarsCode)TRAE ships TraeCode as an AI coding engineer and TraeWork as a professional AI work assistant under the Collaborate with Intelligence brand. Plans bundle Auto mode, model usage allowances, unlimited autocomplete on paid tiers, and concurrent cloud tasks in TraeWork.
Explore toolThe practical questions
Frequently asked questions
What is OWASP WrongSecrets used for?
OWASP WrongSecrets is a secrets-management-focused vulnerable application and CTF platform with Docker and cloud demo environments. Players hunt for more than 50 misconfigured or leaked secrets across Java, Docker, and Terraform examples to learn secure secrets handling and detection tooling.
Does OWASP WrongSecrets have a free plan?
Project page states WrongSecrets is free software under the AGPLv3 license with open GitHub resources. This record lists ongoing free access; check the plan limits before starting.
How much does OWASP WrongSecrets cost?
No paid monthly price is listed; this record treats the product as free to start. See the plan cards for entitlements, billing commitments and seat minimums.
Can I use OWASP WrongSecrets through an API?
Not confirmed. API access and subscription access may have different terms; consult the linked sources.
What should I check before choosing it?
Demo Heroku environments and local Docker runs expose intentionally weak secrets and must stay in controlled lab settings.
Price history
No retained pricing changes yet. A current price alone does not establish a historical trend.
How this profile is supported
Identity and profile
Reviewed vendor source
Read original source ↗Facts apply to the named version and check date. Send a sourced correction if something changed.