Loading
The MetroRide developers once stored an API key inside config.yaml, then deleted the file and committed the cleanup. They thought the secret was gone. It was not.
You are given project.zip, a copy of the project's git repository. Your job: dig through the history with git log -p, find the deleted config.yaml, and read the api_key value. It is base64-encoded; decode it to reveal the flag in flag format.
Unzip the archive, open a terminal in the folder, and explore the commits. Deleting a file only removes it from the latest version; every old version stays in the history forever. The real lesson: once a secret is committed, rotate it immediately. Deleting it later does not help.
This challenge only. All names, addresses and data are fictional. Do not test any real system.
Stuck? Open hints in order: a nudge, then the next step, then an explicit pointer. Costs are taken from this solve's points.
Sign in to open hints.
Sign in to submit a flag.
Sign in, then solve this challenge or give up on it to read write-ups.
Files are safe practice artefacts made for this challenge. Open them on your own computer.