Cheat sheet: Secrets in the open

The 39 terms of this lesson, part by part, with the French word a team in France would use.

1. Where secrets leak

Secretsecret: a value that must stay private because it gives access to an account, such as a password or a key.
Credentialsidentifiants: the login and password, or the key, that let someone into an account.
Compromisedcompromis: describes a password or a key that people outside the planned list may have seen, so it must be treated as leaked.
Admin screenback-office: the private pages where a team edits a site's content, such as texts and images, without touching code.
Issue trackeroutil de suivi des tickets: a shared list of requests and bugs, with one item for each, such as GitHub Issues, Jira or Trello.
Hostinghébergement: the service that stores a site's files and sends them to visitors.
Domain namenom de domaine: the readable name of a website, such as leboncoin.fr, which its owner rents by the year.

Version historyhistorique des versions: the list of past versions that a document or a tool keeps, which anyone with access can open.
Historyhistorique: the list of every commit in a project, with what changed, why, who made it and when.
GitGit: the most common version control tool, which saves each change to a project as a commit.
Repositorydépôt: the project's folder, also called a repo, with all its files and the history of every saved change.
Botbot, robot: a program that visits sites or calls services by itself, sometimes thousands of times an hour.
Revokerévoquer: to cancel a key at the service, so that it stops working for anyone who has a copy.
Rotaterenouveler, faire une rotation: to replace a password or a key with a new one, so that every old copy stops working.

Logslogs, journaux: the record a server keeps of what it did, with the time of each action and any errors.
Two-factor authenticationauthentification à deux facteurs, 2FA: a login that asks for a second proof, such as a code on your phone, as well as the password.
Personal data breachviolation de données personnelles: a leak, loss or change of personal data, which may have to be reported to the CNIL within 72 hours.
CNILCNIL: the French authority for personal data, which receives reports of breaches and can fine organisations.
GDPRRGPD: the European law on personal data, which applies as soon as a site collects a name or an email.
Sign-offvalidation: a written approval that one part of the work is accepted, so the next part can start.

Password managergestionnaire de mots de passe: an app that stores passwords encrypted and shares each one only with the people you choose, such as Bitwarden.
Environment variablevariable d'environnement: a value, such as a key, that the code reads from the computer it runs on.
.env filefichier .env: a file on your computer that holds the project's environment variables and must never be committed.
Shared accountcompte partagé: one login used by several people, so nobody can tell who did what or remove one person's access.
Two-factor authenticationauthentification à deux facteurs, 2FA: a login that asks for a second proof, such as a code on your phone, as well as the password.
Logslogs, journaux: the record a server keeps of what it did, with the time of each action and any errors.

Least privilegeprincipe du moindre privilège: the rule that every person and every tool gets only the access its job needs, for as long as it needs it.
Rolerôle: a set of permissions in a service, such as viewer, editor or admin, given to each account.
Adminadministrateur: the role that can do everything in a service, including adding and removing other accounts.
Read-only accessaccès en lecture seule: an access that lets you see data, but not change or delete it.
AI agentagent d'IA: a program that reads and writes a project's files and runs commands, following your requests in a chat.
Two-factor authenticationauthentification à deux facteurs, 2FA: a login that asks for a second proof, such as a code on your phone, as well as the password.

Password managergestionnaire de mots de passe: an app that stores passwords encrypted and shares each one only with the people you choose, such as Bitwarden.
Rotaterenouveler, faire une rotation: to replace a password or a key with a new one, so that every old copy stops working.
Least privilegeprincipe du moindre privilège: the rule that every person and every tool gets only the access its job needs, for as long as it needs it.
Rolerôle: a set of permissions in a service, such as viewer, editor or admin, given to each account.
Adminadministrateur: the role that can do everything in a service, including adding and removing other accounts.
Two-factor authenticationauthentification à deux facteurs, 2FA: a login that asks for a second proof, such as a code on your phone, as well as the password.
Handoverpassation: the moment when the builders give the site, its accounts and its documents to the client.

Web Technologies · Risk smells · wt.thomasjuldo.com/course/risk-smells/secrets-in-the-open