English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Background: According to GitGuardian's monitoring of public GitHubrepositories, secrets sprawl continued accelerating in 2022 by 67% compared to2021, exposing over 10 million secrets (API keys and other credentials). Thoughmany open-source and proprietary secret detection tools are available, thesetools output many false positives, making it difficult for developers to takeaction and teams to choose one tool out of many. To our knowledge, the secretdetection tools are not yet compared and evaluated. Aims: The goal of our studyis to aid developers in choosing a secret detection tool to reduce the exposureof secrets through an empirical investigation of existing secret detectiontools. Method: We present an evaluation of five open-source and fourproprietary tools against a benchmark dataset. Results: The top three toolsbased on precision are: GitHub Secret Scanner (75%), Gitleaks (46%), andCommercial X (25%), and based on recall are: Gitleaks (88%), SpectralOps (67%)and TruffleHog (52%). Our manual analysis of reported secrets reveals thatfalse positives are due to employing generic regular expressions andineffective entropy calculation. In contrast, false negatives are due to faultyregular expressions, skipping specific file types, and insufficient rulesets.Conclusions: We recommend developers choose tools based on secret types presentin their projects to prevent missing secrets. In addition, we recommend toolvendors update detection rules periodically and correctly employ secretverification mechanisms by collaborating with API vendors to improve accuracy.

A Comparative Study of Software Secrets Reporting by Secret Detection Tools