Unit 1: Secrets in code · Lesson 3 of 4 · 16 min
Rotate, then prove the old key is dead
Use the payments provider's access log to see who used the leaked key, when it was revoked and whether the new key works.
mission
- You are
- You are leading the response to the leaked payments key.
- Situation
- The key was public for a week. Maya revoked it on 12 September and issued a new one. Legal wants to know whether anyone else used it.
- Goal
- Separate Quayside's own traffic from everyone else's, and confirm the old key now fails.
- Hand in
- A timeline of outside use and proof that the old key is rejected.
Provider access logs are the evidence that matters after a leak. Quayside's servers sit in 10.40.1.0/24, so anything else using the key is someone else.
Count requests by source
grep 7Hq2 logs/payments-api-access.log | grep -o 'ip=[0-9.]*' | sort | uniq -c
4 ip=10.40.1.12
2 ip=10.40.1.13
1 ip=198.51.100.23
4 ip=203.0.113.77
you should see Two internal addresses, plus two outside addresses that should never have had the key.
Read every outside request
grep -v 'ip=10\.' logs/payments-api-access.log
2026-09-06T03:12:44Z key=qsk_live_****7Hq2 ip=203.0.113.77 action=list_customers status=200
2026-09-06T03:13:02Z key=qsk_live_****7Hq2 ip=203.0.113.77 action=list_customers status=200
2026-09-06T03:15:40Z key=qsk_live_****7Hq2 ip=203.0.113.77 action=export_customers status=200
2026-09-09T22:41:19Z key=qsk_live_****7Hq2 ip=198.51.100.23 action=list_customers status=200
2026-09-12T09:30:11Z key=qsk_live_****7Hq2 ip=203.0.113.77 action=list_customers status=401
you should see 203.0.113.77 listed and exported customers the morning after the repo went public. A second address tried on 9 September.
defender tip Export actions on customer data turn a leaked key into a reportable data breach in many countries. Record exact times for the incident report.
Confirm the rotation worked
grep -E 'revoke_key|Ts5G|status=401' logs/payments-api-access.log
2026-09-12T09:00:00Z key=qsk_live_****7Hq2 ip=10.40.1.12 action=revoke_key status=200
2026-09-12T09:00:05Z key=qsk_live_****Ts5G ip=10.40.1.12 action=create_charge status=200
2026-09-12T09:30:11Z key=qsk_live_****7Hq2 ip=203.0.113.77 action=list_customers status=401
you should see The old key was revoked at 09:00, the new key Ts5G works, and the outside address gets 401 when it tries again.
What a defender takes away
- 1After revoking a key, read the provider's logs for every use of it.
- 2Know your own source addresses so outside use stands out.
- 3A failed request with the old key is the proof that rotation worked.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.