Jeroen Willemsen and Ben de Haan -- Dirty little secrets

Secrets management fails in surprisingly ordinary ways: credentials land in code, deployment files, containers, and cloud resources, then quietly become part of the system’s attack surface. Jeroen Willemsen and Ben de Haan join Chris and Robert to introduce OWASP WrongSecrets, an intentionally vulnerable application built to teach those failure modes. They explain how the project grew from incident-response experience, why cloud services change the threat model, and how teams can reason about blast radius and maturity. The conversation closes with practical guidance for scaling secrets management across an organization and using hands-on challenges to turn abstract advice into memorable engineering lessons.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Jeroen Willemsen and Ben de Haan:
→ Jeroen Willemsen on LinkedIn
→ OWASP WrongSecrets

Mentioned in this episode:
→ OWASP WrongSecrets
→ WrongSecrets on GitHub
→ Secrets management deployment guidance
→ Terraform
→ Docker
→ Kubernetes

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 The dirty little secrets in software delivery
02:00 How incident response shaped the project
05:51 Introducing OWASP WrongSecrets
08:46 Why secrets management keeps failing
11:22 Cloud storage and common mistakes
16:33 Maturity, threat models, and blast radius
19:23 Turning real failures into challenges
23:03 Secrets hidden in containers and deployment files
27:36 Advice for security and engineering teams
30:02 Scaling secrets management
31:54 Written guidance and project resources
33:39 Final takeaways