This repository is a demonstration and testing environment for CyberArk Conjur. It is designed for local development, testing, and educational purposes only. This repository intentionally contains example credentials, certificates, and API keys to facilitate demos and learning.

This repository contains the following types of example data that appear in the git history:

1. Demo Certificates (demos/cluster/files/certs/*.key.pem)

   • Self-signed SSL/TLS certificates for the fake domain mycompany.local
   • Used for local Docker-based Conjur cluster demonstrations
   • Generated by the bin/generate-certs script for testing purposes

2. Example Private Keys (demos/aws-authentication/jason-conjur-test.pem)

   • Sample SSH key for AWS authentication demos
   • Used only in local development scenarios
   • Not associated with any real infrastructure

3. Demo Credentials in Example Scripts (curl_examples/check)

   • Standard demo username/password: admin:secret
   • Used to demonstrate Conjur API authentication patterns
   • Never used in production environments

4. Example Command Output (demos/certificate-authority/mutual-tls/README.md)

   • Tutorial documentation showing expected output from demo commands
   • Contains transient API keys generated during demo setup
   • Values are ephemeral and only valid in local demo environments

Throughout this repository, you'll find standard demo credentials that are well-known and intentionally non-secret:

• Admin username: admin
• Demo passwords: SEcret12!!!!, MySecretP@ss1, secret
• Test account names: demo, cucumber:user:bob, cucumber
• Fake domains: mycompany.local, *.mycompany.local

⚠️ WARNING: This repository and its contents should never be deployed to production environments or used with real infrastructure.

This repository includes a .gitleaks.toml configuration file that whitelists:

• Demo certificate directories
• Example credential files
• Tutorial documentation with example output
• Historical migration commits containing demo files

These files are intentionally whitelisted because they contain demo/test data, not real secrets.

If you discover what you believe to be a real security vulnerability (not demo/example credentials), please report it by:

1. Do NOT open a public GitHub issue
2. Contact the repository maintainers privately
3. Provide details about the issue and its potential impact

We will respond to legitimate security reports promptly.

When using this repository:

1. ✅ DO use this repository for local testing and learning
2. ✅ DO generate your own certificates for any external testing
3. ✅ DO use strong, unique credentials for any production Conjur deployments
4. ❌ DO NOT use any credentials from this repository in production
5. ❌ DO NOT connect this demo environment to production systems
6. ❌ DO NOT use the example certificates for anything beyond local testing

For production deployments of CyberArk Conjur:

1. Follow CyberArk's official security hardening guidelines
2. Use properly signed certificates from a trusted Certificate Authority
3. Generate strong, unique credentials for all accounts
4. Implement proper secret rotation policies
5. Follow the principle of least privilege
6. Enable audit logging and monitoring
7. Regularly update to the latest stable versions

• CyberArk Conjur Documentation
• Conjur Enterprise Security Documentation

Last Updated: November 2025