Hey, Your Secrets Leaked! Detecting and Characterizing Secret Leakage in the Wild

作者：Jiawei Zhou, Zidong Zhang, Lingyun Ying, Huajun Chai, Jiuxin Cao, Haixin Duan · 年份：2025 · DOI：10.1109/sp61157.2025.00122 · 被引用次数：3 · 研究领域：Digital and Cyber Forensics、Advanced Malware Detection Techniques、Network Security and Intrusion Detection

Secrets, whether structured like API keys or un-structured like passwords, are essential for securing applications and services. However, the growing use of open -source projects and rapid development cycles has amplified the risk of secret leakage. Current detection tools suffer from high false positive rates and low recall due to simplistic methods like regular expressions and entropy checks, often missing unstructured secrets or mislabeling non-sensitive data. In this paper, we introduce Keysentinel, an advanced automated secret detection tool that addresses these limitations through machine learning, semantic analysis, and prefix matching. To evaluate KEYSENTINEL, we created the first cross-platform benchmark with 11,826 labeled secrets in 1,806,530 files across GitHub, PyPI, and WeChat. We compare Key-sentinelwith six currently available tools. The results show KEYSENTINEL achieves state-of-the-art performance, with precision (91.18%), recall (81.71%), and an F1 score (0.86), surpassing industry-standard tools and significantly reducing false positives. It also outperforms large language models like GPT-4 and o1 in accuracy and cost-effectiveness. Besides, we conduct a large-scale measurement study, analyzing 80,330,098 files from GitHub, PyPI, and WeChat. We found that up to 30% of projects are at risk of secret leaks. Furthermore, we also scan the code base of an IT company to assess real-world secret leakage risks. Our findings underscore the pervasive nature of secre...