Identification and Mitigation of Unintentional Insider Information Leak Threats in Public Repositories

Software vulnerabilities on public repositories such as GitHub pose a serious threat to software project development, compromising system availability, data integrity, and confidentiality. This work addresses the need for high-quality software development and effective cybersecurity practices by introducing CredStroller, a tool designed to passively identify potential vulnerabilities in public GitHub repositories. CredStroller offers a unique advantage over scanning tools in that it can scan source code using regular expression patterns across many large numbers of repositories, including those not related to the organization. This capability helps identify mistakes made by developers when they inadvertently upload sensitive source code to their personal GitHub accounts, which are not managed by the organization. The development of a Chrome plugin for CredStroller was motivated by the ease of use and the quick and easy visual identification of secrets it provides. By providing greater accuracy and data coverage for vulnerability detection, CredStroller presents a significant contribution to improving cybersecurity practices. This paper highlights the approach and procedures used to create the Chrome plugin tool and presents results from testing the tool, demonstrating its effectiveness in identifying vulnerabilities. The conclusion summarizes the key findings and highlights the contributions of this work towards achieving that goal.