TY - GEN

T1 - Pushed by Accident: A Mixed-Methods Study on Strategies of Handling Secrets in Source Code Repositories

AU - Krause, Alexander

AU - Klemmer, Jan H.

AU - Huaman, Nicolas

AU - Wermke, Dominik

AU - Acar, Yasemin

AU - Fahl, Sascha

N1 - Funding Information: We want to thank all survey participants and interviewees for supporting our research. Furthermore, we thank the anonymous reviewers and our shepherd for their constructive feedback. This research was funded in part by the VolkswagenStiftung Niedersächsisches Vorab – ZN3695, the Deutsche Forschungsgemeinschaft (DFG, German Research Foundation) under Germany’s Excellence Strategy – EXC 2092 CASA – 390781972, and NSF grants CNS-2206865 and CNS-2207008. Any findings and opinions expressed in this material are those of the authors and do not necessarily reflect the views of the funding agencies.

PY - 2023

Y1 - 2023

N2 - Version control systems for source code, such as Git, are key tools in modern software development. Many developers use services like GitHub or GitLab for collaborative software development. Many software projects include code secrets such as API keys or passwords that need to be managed securely. Previous research and blog posts found that developers struggle with secure code secret management and accidentally leaked code secrets to public Git repositories. Leaking code secrets to the public can have disastrous consequences, such as abusing services and systems or making sensitive user data available to attackers. In a mixed-methods study, we surveyed 109 developers with version control system experience. Additionally, we conducted 14 in-depth semi-structured interviews with developers who experienced secret leakage in the past. 30.3% of our participants encountered code secret leaks in the past. Most of them face several challenges with secret leakage prevention and remediation. Based on our findings, we discuss challenges, such as estimating the risks of leaked secrets, and the needs of developers in remediating and preventing code secret leaks, such as low adoption requirements. We conclude with recommendations for developers and source code platform providers to reduce the risk of secret leakage.

AB - Version control systems for source code, such as Git, are key tools in modern software development. Many developers use services like GitHub or GitLab for collaborative software development. Many software projects include code secrets such as API keys or passwords that need to be managed securely. Previous research and blog posts found that developers struggle with secure code secret management and accidentally leaked code secrets to public Git repositories. Leaking code secrets to the public can have disastrous consequences, such as abusing services and systems or making sensitive user data available to attackers. In a mixed-methods study, we surveyed 109 developers with version control system experience. Additionally, we conducted 14 in-depth semi-structured interviews with developers who experienced secret leakage in the past. 30.3% of our participants encountered code secret leaks in the past. Most of them face several challenges with secret leakage prevention and remediation. Based on our findings, we discuss challenges, such as estimating the risks of leaked secrets, and the needs of developers in remediating and preventing code secret leaks, such as low adoption requirements. We conclude with recommendations for developers and source code platform providers to reduce the risk of secret leakage.

UR - http://www.scopus.com/inward/record.url?scp=85176098582&partnerID=8YFLogxK

M3 - Conference contribution

BT - Proceedings of the 32nd USENIX Security Symposium

T2 - 32nd USENIX Security Symposium

Y2 - 9 August 2023 through 11 August 2023

ER -