← Back to all challenges ◆◆ Level 4 · Source Disclosure · 150 XP
Wargames Realm

Secrets in the Source

Modern sites pull in JavaScript and config bundles. Developers love leaving "temporary" credentials, TODOs, and keys in those files — and every one ships straight to the browser.

The app

This demo portal loads its settings from a config bundle. The portal works fine — but a careless developer left something in that file they shouldn't have.

Two ways in: open app.config.js ↗ directly and read it, or open DevTools → Network (or Sources) tab, reload, and inspect the loaded scripts.

Scan the config file's comments. Developers stash "staging" or "legacy" credentials in // comments meaning to remove them later — and forget. The flag is one of those values.

Submit the flag

Why it matters: secret-scanning your repos and bundles is now standard practice. Real keys belong in server-side env vars or a vault — never in anything the browser downloads.