Vulnerable app with examples showing how to not use secrets
C-Rank Grade: A (Welcoming) - 63/100
External PR Merge Rate: 68%
Response Time: 4d
First Timer Success: 67%
OWASP/wrongsecrets has a recorded first-timer success rate of 66.7%. Repositories ranked A typically provide actionable feedback during code reviews and actively nurture new community contributors.
Maintainers in OWASP/wrongsecrets respond to incoming external pull requests in approximately 95.4 hours on average. Keeping PRs focused on single tasks and ensuring tests pass helps maintainers review faster.
The C-Rank™ system evaluates GitHub projects on a 0–100 scale using real data: PR merge rates, review turnaround time, active maintainer presence, and first-time contributor success. A score of 63.5 places OWASP/wrongsecrets in the A tier.
The external contributor pull request merge rate for OWASP/wrongsecrets is 68.2%, based on public PR activity from non-core contributors.
OWASP/wrongsecrets currently has 2 active issue(s) tagged with beginner-friendly labels like "good first issue", "beginner", or "up-for-grabs".
Rigorous architecture standards (100% critical review signals). Ensure PRs strictly follow guidelines before requesting review in OWASP/wrongsecrets.
Average Response Latency
Tracks hours until a maintainer leaves a review, comment, or PR response.
External Acceptance Rate
Percentage of community pull requests successfully merged into main.
First PR Conversion
Rate at which developers submitting their first repository PR succeed.
Show contributors that your repository actively reviews and merges external pull requests.
[](https://getmerged.abhishekco.de/OWASP/wrongsecrets?utm_source=github&utm_medium=badge)
Historical health & responsiveness evolution
External PR acceptance
First PR success rate
50% receive response in
90% receive response in
Maintainer review activity heatmap & prime window prediction
Calculating local time...
Calculating local time...
Detected: UTC
Maintainers are most responsive around 03:00 UTC (03:00 UTC in your timezone). Recommended submission window is Monday - Wednesday from 03:00 to 07:00 UTC (03:00 - 07:00 UTC local).
Maintainer Strategy: Maintainer Sweet Spot: PRs under 150 lines merge in ~62 hours (85% approval). Large PRs (>500 lines) take ~458 hours (31% approval). Keep your diff compact for rapid review.
Context What should the challenge scenario be like? We see more and more claude secerets distributed with hardcoded secrets. I want to have a challenge in which a claude skill (Zip) (1 challenge) and a cursor skill markdown file (another challenge) are present with the secret inside. The user has to go through the files and extract the secret as the answer. The implementation should retrieve the secret from the file: it should not be hardcoded in java. the skill files should be present in the resource folder, and possibly be hosted/routed through the backend as well from that folder. What should the participant learn from completing the challenge? STOP CREATING SKILLS WITH CREDENTIALS OR SECERETS INSIDE!!!! GRRRRR For what category would the challenge be? (e.g. Docker, K8s, binary) AI Did you encounter this in real life? Could you tell us more about the scenario? YEs, too many times not to have a challenge for this. Challenge (Simple): have a secret in a cursor skill.md file Chall
Context What should the challenge scenario be like? We have a chat: shared in chatgpt: https://chatgpt.com/share/6a99237a-c2e0-83eb-9a09-a1cf76213ff5 which holds an actual secret. This secret can now be seen by everyone and could be used for specific assignments. The idea is that we can use this caht or any more sophisitcated chat "can you provide a username and password geneerated for the following system?" And then have the chat link in the challenge and describe in the challenge why this is a bad idea , whle users only need ot copy the password as the answer. What should the participant learn from completing the challenge? Be careful with sharing chatgpt chats and other AI chats iwth sensitive information For what category would the challenge be? (e.g. Docker, K8s, binary) AI Did you encounter this in real life? Could you tell us more about the scenario? Tons of times in differnet ocmpanies
Rate what actually matters after opening a pull request here.
Rate your first-hand PR experience (review speed, maintainer responsiveness, and onboarding ease) to help other contributors.
When evaluating whether to contribute to OWASP/wrongsecrets, response velocity and maintainer engagement are crucial. GetMerged continuously tracks pull request trajectories, first-comment latency, and code review rounds to help developers avoid submitting pull requests to backlogged repositories.
Currently, maintainers of OWASP/wrongsecrets acknowledge new external contributions in approximately 3 days+. Out of all submitted pull requests from non-core authors in the last 180-day window, 68.2% were successfully merged into the primary branch.
OWASP/wrongsecrets has a recorded first-timer success rate of 66.7%. Repositories ranked Welcoming typically provide actionable feedback during code reviews and actively nurture new community contributors.
The initial maintainer response time averages ~3 days+. Keeping PRs scoped to single concerns and ensuring CI checks succeed will optimize review turnaround.
The C-Rank™ index scores repositories on a 0 to 100 scale using an objective formula: external PR merge rates, initial response speed, active maintainer count, and first-time contributor retention. A score of 63.5 places OWASP/wrongsecrets in the Welcoming tier.
The external pull request merge rate is 68.2%. GetMerged isolates non-core community contributions so external developers get an accurate benchmark of PR acceptance probability.
Yes, OWASP/wrongsecrets currently has 2 active issue(s) tagged with beginner-friendly labels. You can inspect these directly from the repository issues tab.
All metrics displayed for OWASP/wrongsecrets are automatically retrieved via the public GitHub API and recalculated daily. Insider pull requests submitted by repository owners or organization members are excluded from merge rate calculations to preserve objective external contributor statistics.