Enhancing the Efficiency of Secret Detection in Version Control Systems Using Machine Learning Methods

The growing amount of leaked data from version control systems exceeds tens of millions of secrets. Due to a lack of awareness or human error, many developers frequently expose sensitive information such as API keys and tokens, making them publicly accessible. The loss of such data can lead to significant reputational and financial damages for businesses. As a result, there is a critical need for tools that detect potential secrets and prevent their exposure to third parties.Existing tools primarily rely on regular expressions and entropy-based methods for secret detection. However, these approaches often produce a high number of false positives while also failing to detect certain secrets, making them inefficient.To improve the accuracy of secret detection, a combination of a neural transformer-based model, CodeBERT, and a gradient boosting algorithm, XGBoost, was used. CodeBERT analyzes context to determine whether a given string contains a secret, while XGBoost classifies secrets based on numerical features. The models were trained on a specially prepared dataset that included real secrets, fake secrets that mimic the structure of real ones but are inactive, and non-secret code elements such as variables, comments, and configuration files.To evaluate the effectiveness of the models, a directory containing a large number of actual potential secrets and secret-like data that do not qualify as secrets was used. After testing common secret detection tools, their performance was assessed, demonstrating that the hybrid CodeBERT and XGBoost model achieves significantly higher accuracy in detecting secrets. The proposed approach can be applied to source code monitoring and security, enabling automated scanning in platforms such as GitHub, GitLab, and Bitbucket, as well as local validation. This makes it an effective security measure before code is published to version control systems.