claude
fbec36cb67
Scaffold the course repo and author the full curriculum in dependency-chain order, following the settled build decisions in handoff.md. - Scaffold: course README, vendor-neutral AGENTS.md (dogfoods Module 5), _TEMPLATE.md (the fixed 9-section module shape), root .gitignore, ship config. - Modules 1-2: reference exemplars (locked for tone/depth/lab style). - Modules 3-27: full lessons + runnable labs, each following the template, respecting the chain, vendor/model-agnostic, with "feel the pain" labs. - Module 8 hosting comparison web-researched and date-stamped (as of 2026-06-22), not written from memory; expansion-zone modules carry Verify-before-publish. - Capstone: the full loop end to end on the running tasks-app example. Lab code syntax-checked (Python/shell/YAML); every module has the 7 core template sections. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TfzV5QvtPDz8LJS3Pu5VLT
29 lines
1.4 KiB
Python
29 lines
1.4 KiB
Python
"""Cloud-sync config for tasks-app — a realistic snapshot of what an AI hands you.
|
|
|
|
Asked to "sync tasks to a cloud service," a model will cheerfully produce something like this: it
|
|
works, it reads naturally, it passes lint and tests... and it has a live credential baked straight
|
|
into the source. That is the *exact* failure mode Module 15's secret-scanning gate exists to catch.
|
|
|
|
DO NOT copy this pattern. The point of this file is to be caught by a scanner, not imitated.
|
|
The fix (read from the environment) is shown at the bottom, commented out, so you can see the
|
|
difference once Part C of the lab is done.
|
|
"""
|
|
|
|
# --- The problem the scanner should flag -------------------------------------------------------
|
|
# A hardcoded API key. Looks like a normal string literal; lint and tests will never complain.
|
|
SYNC_API_KEY = "sk_live_9c3f2a7b41d84e0fa6b2c5d8e1f09a73bdac46"
|
|
SYNC_ENDPOINT = "https://api.example-task-cloud.com/v1/sync"
|
|
|
|
|
|
def sync_headers() -> dict:
|
|
return {"Authorization": f"Bearer {SYNC_API_KEY}"}
|
|
|
|
|
|
# --- The fix (Part C) --------------------------------------------------------------------------
|
|
# Read the secret from the environment instead of committing it. Proper secret management — env
|
|
# files, secret stores, per-environment config — is Module 17. This is just enough to make the
|
|
# scanner go quiet honestly.
|
|
#
|
|
# import os
|
|
# SYNC_API_KEY = os.environ["SYNC_API_KEY"] # set it outside the repo; never commit the value
|