Checked-In Secret Detection: Strings Are All You Need

2026-08-05

AI Summary

This work addresses key challenges in hardcoded secret detection, including low precision of regex-based methods, vulnerability of context-aware models to obfuscation, poor cross-language generalization, and redundant contextual information. The authors propose StringGroup, an approach that focuses on string literals to extract high-density semantic context, and implement Secretron—a Transformer-based tool for efficient detection. By leveraging strings as a rich, obfuscation-resilient, and language-agnostic source of critical signals, the method compresses contextual length to 33.2% of the original while preserving over 80% of semantic content, substantially improving signal-to-noise ratio. Evaluated on SecretBench, the approach achieves an F1 score of 98.74%, outperforms LLM baselines in robustness against obfuscation and cross-language performance, and successfully uncovers 48 previously unknown secrets across 26 real-world software projects.

Abstract

Hardcoded secrets in source code pose critical security vulnerabilities which can be easily exploited by malicious adversaries. Existing regex-based detection approaches suffer from fundamental limitations, as secrets often lack identifiable patterns, resulting in poor precision and recall. Recent studies have explored context-aware detection methods, as surrounding code can reveal the purpose of candidate strings. However, these methods confront three key challenges: (1) obfuscation robustness where models over-rely on easily obfuscated identifiers, (2) cross-language generalization difficulties due to uneven training data distribution, and (3) lengthy and noisy context that introduces excessive irrelevant tokens and slows inference. We observe that strings serve as a critical information source for code semantics, offering superior contextual density, obfuscation robustness, and language independence. Based on this insight, we propose StringGroup, a novel context extraction algorithm that mines strings surrounding potential secrets. By introducing a relatively simple modification to existing patterns that narrows the analysis specifically to string literals, the method achieves significant gains. With only 33.2% of the original context, it preserves over 80% of semantic information and significantly improves the signal-to-noise ratio for secret detection. We further design a context-aware secret detection tool, Secretron, based on StringGroup methods and Transformer model. Evaluation on the SecretBench dataset demonstrates high accuracy with 98.74% F1-score and strong robustness under obfuscation and cross-language scenarios, outperforming state-of-the-art LLM-based baselines. We deploy our tool in real-world environments and successfully detect 48 previously unknown secret keys from 26 applications, demonstrating the practical effectiveness of our approach.

Problem

• secret detection
• obfuscation robustness
• cross-language generalization
• context noise
• hardcoded secrets

Innovation

• StringGroup
• secret detection
• context extraction
• obfuscation robustness
• cross-language generalization