[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"me":3,"catalog:en:security\u002Fds-secrets-pipeline-management":4,"config":232},null,{"field_key":5,"field_name":6,"seniority":7,"topic_key":8,"topic_name":9,"spec_key":7,"spec_name":7,"locale":10,"cell_total":11,"field_total":12,"seniorities":13,"topics":17,"specs":130,"samples":147},"security","Security","","ds-secrets-pipeline-management","Ds Secrets Pipeline Management","en",75,2850,[14,15,16],"junior","mid","senior",[18,21,24,27,30,33,36,39,42,45,48,51,54,57,60,63,66,69,72,75,78,79,82,85,88,91,94,97,100,103,106,109,112,115,118,121,124,127],{"key":19,"name":20,"count":11},"as-access-control-idor","As Access Control Idor",{"key":22,"name":23,"count":11},"as-api-security","As Api Security",{"key":25,"name":26,"count":11},"as-authentication-session","As Authentication Session",{"key":28,"name":29,"count":11},"as-crypto-implementation-pitfalls","As Crypto Implementation Pitfalls",{"key":31,"name":32,"count":11},"as-injection-input-validation","As Injection Input Validation",{"key":34,"name":35,"count":11},"as-secure-sdlc-sast-dast","As Secure Sdlc Sast Dast",{"key":37,"name":38,"count":11},"bt-crisis-communication-management","Bt Crisis Communication Management",{"key":40,"name":41,"count":11},"bt-detection-engineering-tuning","Bt Detection Engineering Tuning",{"key":43,"name":44,"count":11},"bt-digital-forensics-fundamentals","Bt Digital Forensics Fundamentals",{"key":46,"name":47,"count":11},"bt-incident-triage-classification","Bt Incident Triage Classification",{"key":49,"name":50,"count":11},"bt-ir-playbook-execution","Bt Ir Playbook Execution",{"key":52,"name":53,"count":11},"bt-threat-intelligence-application","Bt Threat Intelligence Application",{"key":55,"name":56,"count":11},"cse-container-workload-security","Cse Container Workload Security",{"key":58,"name":59,"count":11},"cse-cspm-misconfiguration","Cse Cspm Misconfiguration",{"key":61,"name":62,"count":11},"cse-data-protection-governance","Cse Data Protection Governance",{"key":64,"name":65,"count":11},"cse-detection-incident-response","Cse Detection Incident Response",{"key":67,"name":68,"count":11},"cse-iam-privilege-escalation","Cse Iam Privilege Escalation",{"key":70,"name":71,"count":11},"cse-network-perimeter-zero-trust","Cse Network Perimeter Zero Trust",{"key":73,"name":74,"count":11},"ds-iac-policy-as-code","Ds Iac Policy As Code",{"key":76,"name":77,"count":11},"ds-pipeline-security-gates","Ds Pipeline Security Gates",{"key":8,"name":9,"count":11},{"key":80,"name":81,"count":11},"ds-security-metrics-blameless-culture","Ds Security Metrics Blameless Culture",{"key":83,"name":84,"count":11},"ds-shift-left-security-culture","Ds Shift Left Security Culture",{"key":86,"name":87,"count":11},"ds-software-supply-chain-pipeline","Ds Software Supply Chain Pipeline",{"key":89,"name":90,"count":11},"pt-legal-ethical-boundaries","Pt Legal Ethical Boundaries",{"key":92,"name":93,"count":11},"pt-methodology-phases","Pt Methodology Phases",{"key":95,"name":96,"count":11},"pt-red-team-engagement-management","Pt Red Team Engagement Management",{"key":98,"name":99,"count":11},"pt-reporting-remediation-prioritization","Pt Reporting Remediation Prioritization",{"key":101,"name":102,"count":11},"pt-scoping-rules-of-engagement","Pt Scoping Rules Of Engagement",{"key":104,"name":105,"count":11},"pt-vulnerability-assessment-vs-pentest","Pt Vulnerability Assessment Vs Pentest",{"key":107,"name":108,"count":11},"security-authn-authz","Security Authn Authz",{"key":110,"name":111,"count":11},"security-cloud-infra-security","Security Cloud Infra Security",{"key":113,"name":114,"count":11},"security-compliance-risk","Security Compliance Risk",{"key":116,"name":117,"count":11},"security-cryptography-basics","Security Cryptography Basics",{"key":119,"name":120,"count":11},"security-incident-response","Security Incident Response",{"key":122,"name":123,"count":11},"security-network-security","Security Network Security",{"key":125,"name":126,"count":11},"security-secure-sdlc","Security Secure Sdlc",{"key":128,"name":129,"count":11},"security-web-vulnerabilities","Security Web Vulnerabilities",[131,135,138,141,144],{"key":132,"name":133,"count":134},"appsec","AppSec",450,{"key":136,"name":137,"count":134},"blue-team-incident","Blue Team \u002F Incident",{"key":139,"name":140,"count":134},"cloud-security","Cloud Security",{"key":142,"name":143,"count":134},"devsecops","DevSecOps",{"key":145,"name":146,"count":134},"offensive-pentest","Offensive \u002F Pentest",[148,166,179,192,206,219],{"id":149,"topic":9,"difficulty":150,"body":151,"options":152,"correct_key":157,"explanation":165},"019fab8f-ce1b-76b3-83c4-e934ab68aed4",1,"Why is hardcoding a database password directly inside a CI\u002FCD pipeline YAML file considered a bad practice?",[153,156,159,162],{"key":154,"text":155},"a","It makes the pipeline file larger, which slows down the CI system's YAML parser on every run",{"key":157,"text":158},"b","The password becomes part of the repository's git history, retrievable by anyone with read access.",{"key":160,"text":161},"c","YAML files cannot store string values longer than 64 characters, so long passwords get silently truncated",{"key":163,"text":164},"d","CI\u002FCD platforms reject pipeline files that contain literal string values inside job definitions","A secret written directly into a YAML file is committed to git and stays in history forever, even if removed later. Anyone with repo read access, including former employees or a public fork, can recover it. Secrets belong in a dedicated secret store injected at run time, not in version-controlled files.",{"id":167,"topic":9,"difficulty":150,"body":168,"options":169,"correct_key":154,"explanation":178},"019fab8f-ce1c-70b8-abe3-62be853bddbb","What is the primary purpose of a pre-commit secret-scanning hook (e.g. a tool that runs before `git commit` completes)?",[170,172,174,176],{"key":154,"text":171},"It inspects the changes being committed and blocks the commit locally if it detects a pattern that looks like an API key, token, or credential",{"key":157,"text":173},"It automatically encrypts every file in the repository so committed content is unreadable without a key",{"key":160,"text":175},"It replaces all environment variables in the code with placeholder values before the commit is created",{"key":163,"text":177},"It compresses the commit diff to reduce the repository's total disk usage over time","A pre-commit secret-scanning hook runs on the developer's machine before the commit is finalized, scanning the staged diff for patterns matching known credential formats (AWS keys, private keys, tokens). If a match is found, it blocks the commit locally, stopping the secret from ever reaching the remote repository in the first place.",{"id":180,"topic":9,"difficulty":150,"body":181,"options":182,"correct_key":163,"explanation":191},"019fab8f-ce1c-7836-b4ab-92020dff2627","A developer accidentally commits a `.env` file containing a real API key. A pre-commit hook was not installed on their machine, so the commit reaches the shared remote repository. What is the most important immediate action?",[183,185,187,189],{"key":154,"text":184},"Rename the `.env` file in a follow-up commit so the original file path no longer exists",{"key":157,"text":186},"Ask the developer to delete the file from their local working directory only",{"key":160,"text":188},"Wait until the next scheduled secret-scanning pipeline run to confirm whether the key is actually sensitive",{"key":163,"text":190},"Treat the key as compromised and revoke\u002Frotate it immediately.","Once a secret reaches a shared remote repository's history, it must be treated as compromised, because git history retains it even after a later commit removes or renames the file. The only safe response is to revoke and rotate the credential immediately at the source system; cleaning history is a secondary, best-effort step.",{"id":193,"topic":9,"difficulty":194,"body":195,"options":196,"correct_key":157,"explanation":205},"019fab8f-ce1d-71e4-b0c7-e725d2c5ffda",2,"Most CI\u002FCD platforms (GitHub Actions, GitLab CI) automatically mask a registered secret's exact value in build logs. What is a key limitation of this masking?",[197,199,201,203],{"key":154,"text":198},"Masking only works for secrets shorter than 8 characters, so longer API keys are always shown in plain text",{"key":157,"text":200},"If the secret value is transformed (e.g. base64-encoded, split across two log lines, or printed in a different case) before being written to the log, the masking may fail to recognize and redact it",{"key":160,"text":202},"Masking disables the entire pipeline run whenever any secret is referenced in a job step",{"key":163,"text":204},"Masking permanently deletes the secret from the CI platform's secret store after its first use in a log line","Log masking typically works by exact substring matching against the known secret value. If a script transforms the value before printing it -encoding it, splitting it across lines, or changing case- the masking engine may no longer recognize the pattern, letting the real value leak into the log in plain text.",{"id":207,"topic":9,"difficulty":150,"body":208,"options":209,"correct_key":154,"explanation":218},"019fab8f-ce1d-7a92-b639-38423f513eac","In a CI\u002FCD pipeline, what does injecting a secret 'as an environment variable at run time' mean, compared to hardcoding it in the source?",[210,212,214,216],{"key":154,"text":211},"The CI system fetches the secret from its secret store right before the job runs and exposes it only inside that job's process environment, never persisting it in the checked-out source files",{"key":157,"text":213},"The secret is written into the source code repository but encrypted with a key that only the pipeline knows",{"key":160,"text":215},"The secret is compiled into the application binary as a constant so it never needs to be fetched again",{"key":163,"text":217},"The secret is emailed to the pipeline operator, who manually types it into a terminal during each deployment","Injecting a secret as an environment variable means the CI platform retrieves it from its secret store at job start time and makes it available only to that job's running process, as an in-memory environment variable. It never touches the checked-out source tree, unlike a hardcoded value.",{"id":220,"topic":9,"difficulty":194,"body":221,"options":222,"correct_key":163,"explanation":231},"019fab8f-ce1e-745b-b9df-da382222b206","Why is it risky to give a CI\u002FCD pipeline's cloud deployment credential the same broad permissions as a human administrator account?",[223,225,227,229],{"key":154,"text":224},"Broad permissions make the pipeline run measurably slower because the cloud API has to check more permission rules per request",{"key":157,"text":226},"Cloud providers charge extra fees for credentials that have administrator-level permissions attached",{"key":160,"text":228},"Administrator credentials expire faster than scoped credentials, forcing more frequent manual rotation",{"key":163,"text":230},"If the pipeline (or any dependency, script, or compromised job step within it) is compromised, an attacker inherits the full blast radius of an administrator, far beyond what the pipeline actually needs to deploy the application","The pipeline credential should follow least privilege: scoped only to the actions and resources the deployment actually requires. If it instead holds admin-level rights, any compromise of the pipeline (a malicious dependency, a leaked token, a compromised action) gives the attacker admin-level blast radius across the whole cloud account, not just deployment access.",{"fields":233,"seniorities":407,"interview_shapes":408,"locales":413,"oauth":415,"question_count":418,"coach_enabled":419,"jd_match_enabled":419},[234,259,279,296,320,333,352,371,381,388,394,401],{"key":235,"name_tr":236,"name_en":236,"sort":150,"specializations":237},"backend","Backend",[238,241,244,247,250,253,256],{"key":239,"name":240,"field":235},"general","Genel",{"key":242,"name":243,"field":235},"go","Go",{"key":245,"name":246,"field":235},"python","Python",{"key":248,"name":249,"field":235},"java","Java",{"key":251,"name":252,"field":235},"csharp","C#\u002F.NET",{"key":254,"name":255,"field":235},"nodejs","Node.js",{"key":257,"name":258,"field":235},"php","PHP",{"key":260,"name_tr":261,"name_en":261,"sort":194,"specializations":262},"frontend","Frontend",[263,264,267,270,273,276],{"key":239,"name":240,"field":260},{"key":265,"name":266,"field":260},"javascript","JavaScript",{"key":268,"name":269,"field":260},"typescript","TypeScript",{"key":271,"name":272,"field":260},"react","React",{"key":274,"name":275,"field":260},"vue","Vue",{"key":277,"name":278,"field":260},"angular","Angular",{"key":280,"name_tr":281,"name_en":281,"sort":282,"specializations":283},"fullstack","Fullstack",3,[284,285,286,287,288,289,290,291,292,293,294,295],{"key":239,"name":240,"field":280},{"key":242,"name":243,"field":235},{"key":245,"name":246,"field":235},{"key":248,"name":249,"field":235},{"key":251,"name":252,"field":235},{"key":254,"name":255,"field":235},{"key":257,"name":258,"field":235},{"key":265,"name":266,"field":260},{"key":268,"name":269,"field":260},{"key":271,"name":272,"field":260},{"key":274,"name":275,"field":260},{"key":277,"name":278,"field":260},{"key":297,"name_tr":298,"name_en":298,"sort":299,"specializations":300},"devops-cloud","DevOps \u002F Cloud",4,[301,302,305,308,311,314,317],{"key":239,"name":240,"field":297},{"key":303,"name":304,"field":297},"aws","AWS",{"key":306,"name":307,"field":297},"gcp","GCP",{"key":309,"name":310,"field":297},"azure","Azure",{"key":312,"name":313,"field":297},"kubernetes","Kubernetes",{"key":315,"name":316,"field":297},"terraform","Terraform",{"key":318,"name":319,"field":297},"linux","Linux",{"key":321,"name_tr":322,"name_en":322,"sort":323,"specializations":324},"ai-engineer","AI Engineer",5,[325,326,327,330],{"key":239,"name":240,"field":321},{"key":245,"name":246,"field":321},{"key":328,"name":329,"field":321},"llm-rag","LLM\u002FRAG",{"key":331,"name":332,"field":321},"mlops","MLOps",{"key":334,"name_tr":335,"name_en":336,"sort":337,"specializations":338},"database","Veritabanı","Database",6,[339,340,343,346,349],{"key":239,"name":240,"field":334},{"key":341,"name":342,"field":334},"postgresql","PostgreSQL",{"key":344,"name":345,"field":334},"mysql","MySQL",{"key":347,"name":348,"field":334},"mongodb","MongoDB",{"key":350,"name":351,"field":334},"redis","Redis",{"key":353,"name_tr":354,"name_en":355,"sort":356,"specializations":357},"mobile","Mobil","Mobile",7,[358,359,362,365,368],{"key":239,"name":240,"field":353},{"key":360,"name":361,"field":353},"ios-swift","iOS (Swift)",{"key":363,"name":364,"field":353},"android-kotlin","Android (Kotlin)",{"key":366,"name":367,"field":353},"flutter","Flutter",{"key":369,"name":370,"field":353},"react-native","React Native",{"key":5,"name_tr":372,"name_en":6,"sort":373,"specializations":374},"Güvenlik",8,[375,376,377,378,379,380],{"key":239,"name":240,"field":5},{"key":132,"name":133,"field":5},{"key":145,"name":146,"field":5},{"key":139,"name":140,"field":5},{"key":142,"name":143,"field":5},{"key":136,"name":137,"field":5},{"key":382,"name_tr":383,"name_en":384,"sort":385,"specializations":386},"qa-test-automation","QA \u002F Test Otomasyonu","QA \u002F Test Automation",9,[387],{"key":239,"name":240,"field":382},{"key":389,"name_tr":390,"name_en":390,"sort":391,"specializations":392},"data-engineer","Data Engineer",10,[393],{"key":239,"name":240,"field":389},{"key":395,"name_tr":396,"name_en":397,"sort":398,"specializations":399},"game-dev","Oyun Geliştirme","Game Development",11,[400],{"key":239,"name":240,"field":395},{"key":402,"name_tr":403,"name_en":403,"sort":404,"specializations":405},"ml-engineer","ML Engineer",12,[406],{"key":239,"name":240,"field":402},[14,15,16],{"junior":409,"mid":411,"senior":412},{"questions":410,"median_sec":3},20,{"questions":410,"median_sec":3},{"questions":410,"median_sec":3},[414,10],"tr",[416,417],"google","github",21750,true]