DEMO (do not merge): intentionally insecure examples

[karlllewis]

🚫 Purposefully Failing PR – Guardrails Demo

Goal: Demonstrate CNCISO’s secure-by-default-starter guardrails in action.
This PR intentionally includes insecure files that violate our security posture.

---

❌ What’s in this PR

• examples/bad_secret.txt → Harmless fake token string to trigger Gitleaks locally.
• examples/Dockerfile.bad → Unpinned base image (:latest) and runs as root.
• examples/pod-insecure.yaml → privileged: true, allowPrivilegeEscalation: true, root user.

---

🔍 Expected Behavior

• Pre-commit hooks: Block commits containing secrets on developer machines.
• CI (security workflow):
  • Run Trivy (vuln + config) and upload SARIF to Code scanning alerts.
  • Generate and publish SBOM (sbom-spdx artifact).
  • Fail the job on HIGH/CRITICAL findings (by design).

---

🧪 How to Reproduce Locally

# secrets guardrail
echo "ghp_FAKE_TOKEN_1234567890ABCDEF" > examples/bad_secret.txt
git add examples/bad_secret.txt
git commit -m "test: add fake token (should fail)"   # should be blocked by Gitleaks

###📚 Next Steps
We'll open a follow-up passing PR that:

• Pins base images and runs as non-root
• Removes insecure settings from k8s manifests
• Keeps SBOM publishing and passes the security workflow

This PR is a teaching tool and will remain unmerged to preserve the failing example

• Dockerfile.bad: https://github.com/cloudnativeciso/secure-by-default-starter/blob/demo-bad-examples-v1/examples/Dockerfile.bad
• pod-insecure.yaml: https://github.com/cloudnativeciso/secure-by-default-starter/blob/demo-bad-examples-v1/examples/pod-insecure.yaml
• bad_secrets.txt: https://github.com/cloudnativeciso/secure-by-default-starter/blob/demo-bad-examples-v1/examples/bad_secrets.txt

[github-advanced-security]

Trivy found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

[karlllewis]

• Dockerfile.bad: https://github.com/cloudnativeciso/secure-by-default-starter/blob/demo-bad-examples-v1/examples/Dockerfile.bad
• pod-insecure.yaml: https://github.com/cloudnativeciso/secure-by-default-starter/blob/demo-bad-examples-v1/examples/pod-insecure.yaml
• bad_secrets.txt: https://github.com/cloudnativeciso/secure-by-default-starter/blob/demo-bad-examples-v1/examples/bad_secrets.txt