Risk-based Secret Detection

Aid practitioners to identify checked-in credentials and mitigate secrets leakage

The goal of this project is to aid software practitioners in reducing the security risk of checked-in secrets through the development of empirically-based tools for identifying and prioritizing the eradication of already checked-in secrets and techniques for securely managing secrets to prevent injection of secrets into a codebase.

Research contributions

Understanding of the developer motivation and decision making related to checking in secrets.
SecretBench, a benchmark of secret-containing files that can be used to compare secret detection tools.
Improved static analysis tools for detecting checked-in secrets.
A risk-based tool for prioritizing the eradication of already checked-in secrets.