# Using AI/ML to Find and Remediate Enterprise Secrets in Code & Document Sharing Platforms

**Authors:** Gregor Kerr, David Algorry, Senad Ibraimoski, Peter Maciver, Sean Moran  
**arXiv:** [2401.01754](https://arxiv.org/abs/2401.01754)  
**Date:** 2024-01-03  
**Summary page:** https://www.summarizepaper.com/en/arxiv-id/2401.01754v1/

## Key points

- Inadvertent exposure of sensitive information in code poses a significant risk to organizations
- Over 100,000 GitHub repositories have been found containing secrets, highlighting the need for preventive measures
- Existing solutions rely on heuristic methods like regular expressions but often generate high levels of noise due to false positives
- AI/ML models are being used to reduce false positives and enhance accuracy in detecting and remediating vulnerabilities
- Proposal to develop AI/ML models capable of pinpointing secrets in code and automatically remediating them, extending detection capability to free text within document sharing platforms

## Summary

, , , , 

In the realm of software development, the inadvertent exposure of sensitive information such as passwords, API tokens, and private keys within code and document sharing platforms poses a significant risk to organizations. A startling discovery revealed over 100,000 GitHub repositories containing such secrets, underscoring the urgency for robust preventive measures [6]. Past incidents of large-scale breaches have underscored the critical need for tools that can effectively detect and mitigate these vulnerabilities [3, 8, 11]. Existing solutions rely on heuristic methods like regular expressions to identify secrets in various environments [4, 5, 10]. While these tools offer a solid foundation for detection, they often generate high levels of noise due to false positive detections caused by faulty regular expressions [2]. <ks>AI/ML models</ks> have gained interest in reducing false positives and enhancing accuracy [9] to address this pressing issue. We present a novel challenge to the software development community: developing AI/ML models capable of accurately pinpointing secrets in code and automatically remediating them with integrated replacements. Additionally, we propose extending this detection capability to free text within collaborative document sharing platforms (DSPs). Our approach involves employing baseline AI/ML models and implementing a human-in-the-loop learning setup to achieve optimal performance. We introduce two distinct baseline models tailored for code and natural language analysis. For code detection, we utilize a language-agnostic machine learning model trained on annotated labels provided by subject matter experts (SMEs). In the case of DSPs, our AI/ML model leverages outputs from heuristic tools to generate weak labels that are subsequently re-annotated based on SME input. Furthermore, we outline an effective openrewrite rules-based solution for automatically remediating detected secrets in code. By combining innovative AI technologies with expert input and rule-based strategies, we aim to revolutionize the identification and mitigation of security vulnerabilities within software development processes. This pioneering approach not only enhances data protection but also streamlines developer workflows by minimizing false positives and automating remediation tasks.