.png){kind=icon}
.png){kind=icon}
Return
Learning to detect hardcoded secrets
.png){kind=icon}
OA
AI
F
M
DOI：10.1007/s10664-026-10929-w.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Numerous tools have been developed to uncover secrets and credentials in source code. However, they often rely on predefined rules that yield a high rate of false positives. We conduct an in-depth investigation into the performance of different AI models in secret detection. In non-generative models, we found that the choice of feature set greatly influences the performance in secret detection. These models demonstrated the best performance using the context feature, i.e., code surrounding the secret value. Particularly, CodeBERT outperforms other models with an MCC and F1-scores of 88% and 89%, respectively. When we applied the models to an unseen dataset of secrets, the top models were Random Forest and CodeBERT, achieving an MCC score of around 65%. In generative models, we observed moderate performance (a maximum MCC of 63%) and a high number of false positives. The investigation of incorrect predictions revealed that many are within test-path files and that LLMs tend to be cautious, flagging potential secrets to promote secure coding practices. We noted that prompt engineering reduces false predictions significantly, yet human intervention remains necessary.
Keywords:
Hardcoded secrets
Credential leakage
AI for security
Journal
IF:
3.6
Papers:
1.9K
Citations:
5.3K
Organization
Cited Papers