The Group Project Repo

Naina and Rehan's first real coding assignment was small on paper and enormous at 1 a.m.: a web form called CampusConnect, where students could submit feedback about hostel food, and the app would email a tidy weekly summary to the mess committee automatically.

The emailing part needed a transactional email service, the kind that hands out a free "API key," a long string of letters and numbers that proves to the service it's really your app asking it to send mail, and not someone else's.

They signed up, got their key, pasted it somewhere in the code that worked, and moved on, the way anyone does at 1 a.m. with a 9 a.m. deadline.

"Somewhere in the code" turned out to be directly inside main.py, in plain text, right next to the line that sent the email: API_KEY = "sk_live_7hT9k2...". It worked immediately, which at 1 a.m. felt like the only thing that mattered.

Sanjeev sir's instructions asked them to push the finished project to a public GitHub repository, so he could clone it and check it ran. Rehan did exactly that, half-asleep, without a second thought for what else was sitting inside main.py the moment it went public.

"Submitted," he said, closing the laptop. "Sleep now, worry later."

Three days later, a notification landed on the CampusConnect repository: a new "issue," titled simply, "Please rotate your email API key, it's exposed in main.py." The message, from a GitHub account called quietpatch0x, was short, polite, and included a direct link to the exact line.

Naina's first reaction wasn't relief. It was suspicion. "Is this a scam?" she asked. "Someone messaging us out of nowhere, about a 'problem,' telling us to act fast?"

It did sound, uncomfortably, like the kind of message they'd learned to distrust by now. The difference, she realised on a second read, was that this one asked them to fix something themselves, on their own account, and wanted nothing from them in return. No link to click, no payment, no document.

Ananya didi read the issue, then the code, then let out a small laugh that wasn't unkind. "It's real," she said. "And quietpatch0x did exactly the right thing. This is called responsible disclosure: finding a security problem and reporting it quietly to the people who can fix it, instead of using it, selling it, or posting it publicly for anyone to grab."

She pulled up the repository's commit history, still fully public. "Public GitHub repos get scanned constantly, by researchers, and by automated bots looking for exactly this pattern, 'sk_live_' followed by a long string. Some bots report it like quietpatch0x did. Others just use it. You got the better kind of attention first, this time."

Sanjeev sir, once looped in, didn't lecture about the mistake itself, every student made it once. He wanted them to understand the part that surprised most people: "If you simply delete that line in a new commit, the key doesn't disappear. It's still sitting in an earlier commit, in the project's full history, which anyone can still browse."

He sketched it on the whiteboard: commit one has the key, commit two removes it, but commit one still exists, forever, unless someone deliberately rewrites history with a tool built for exactly that. "Treat any secret that's ever been committed as burned," he said. "Rotate it. Don't just hide it."

They logged into the email service and revoked the old key within the hour, generating a fresh one. This time, the key went into a separate file named .env, which they added to a new file called .gitignore, a list of files Git is told to never track or upload, ever.

The code itself changed by exactly one line: instead of a string typed directly in, it now read the key from the environment, os.environ.get("API_KEY"), invisible to anyone looking at the public code, present only on the machine actually running it.

Checking the service's usage logs, relief: the free-tier key had a strict sending cap, and nobody had used it for anything in the three days it sat exposed. "We got lucky," Naina said. "Lucky isn't a plan," Ananya didi replied, not unkindly.

Rehan couldn't stop thinking about the message, less about the mistake it pointed out, more about the person who'd found it. "How does someone even find stuff like that?" he asked. "On purpose? Legally?"

"That's a whole world," Ananya didi said, amused. "Ethical hacking, done properly, with rules. Ask me again once you're sure you want the real answer, not just the exciting-sounding one."

Rehan was already sure. He just didn't yet know how close that curiosity would come to getting him into real trouble, barely a week later.