AssetHarvester: A Static Analysis Tool for Detecting Assets Protected by Secrets in Software Artifacts

arXiv:2403.19072v1 Announce Type: new
Abstract: GitGuardian monitored secrets exposure in public GitHub repositories and reported developers leaked over 12 million secrets (database and other credentials) in 2023, indicating a 113% surge from 2021. Despite the availability of secret detection tools, developers ignore the tools' reported warnings because of false positives (25%-99%). However, each secret protects assets of different values accessible through asset identifiers (a DNS name and a public or private IP address). The asset information for a secret can …

analysis artifacts arxiv assets availability credentials cs.cr cs.se database detection developers exposure gitguardian github github repositories leaked public repositories secret secret detection secrets software static analysis tool tools