How Bad Can It Git? Characterizing Secret Leakage in Public GitHub Repositories

Abstract

GitHub and similar platforms have made public collaborative development of software commonplace. However, a problem arises when this public code must manage authentication secrets, such as API keys or cryptographic secrets. These secrets must be kept private for security, yet common development practices like adding these secrets to code make accidental leakage frequent. In this paper, we present the first large-scale and longitudinal analysis of secret leakage on GitHub. We examine billions of files collected using two complementary approaches: a nearly six-month scan of real-time public GitHub commits and a public snapshot covering 13% of open-source repositories. We focus on private key files and 11 high-impact platforms with distinctive API key formats. This focus allows us to develop conservative detection techniques that we manually and automatically evaluate to ensure accurate results. We find that not only is secret leakage pervasive-affecting over 100,000 repositories-but that thousands of new, unique secrets are leaked every day. We also use our data to explore possible root causes of leakage and to evaluate potential mitigation strategies. This work shows that secret leakage on public repository platforms is rampant and far from a solved problem, placing developers and services at persistent risk of compromise and abuse.

The Seven Sins: Security Smells in Infrastructure as Code Scripts

“…Exposing hard-coded secrets, such as hard-coded keys, is not uncommon in GitHub: Meli et al [47] identified 201,642 instances of private keys, which included commonly-used API keys. Meli et al [47] reported 85,311 of the identified 201,642 instances of private keys to be Google API keys.…”

The People Who Live in Glass Houses Are Happy the Stones Weren't Thrown at Them [From the Editors]

“…job titles, and social media uniform resource locators. Meli et al 6 revealed the prevalence of checked credentials, such as passwords or application programming interface keys, by finding more than 100,000 GitHub repositories with credentials.…”

Enabling Collaborative Data Science Development with the Ballet Framework

“…But at the same time, the entirety of the code, including the feature definitions, can be developed publicly without revealing any non-public information about the data. With this strategy, developers and maintainers must monitor submissions to ensure that data is not accidentally copied into source code files -a process that can be automated, similar to scanning for secure tokens and credentials [31,59].…”