A Method for Detecting Secret-Key Leaks in Public Container Images on DockerHub

The leakage of sensitive information, including API tokens and cryptographic keys, has been a significant concern due to its potential risks. While these leaks are not only from source code repositories, DockerHub, the largest container registry due to Docker’s widespread adoption, presents an additional possibility for such exposures. In this paper, we propose a method for detecting secret-key leaks within container images. Employing this approach, an evaluation of approximately 20,000 public images from DockerHub revealed that a random sample showed that around 1.96% of these images exposed over 50 kinds of secrets. Furthermore, 4.68% of the recently added chat application images unintentionally exposed their OpenAI API keys. The research concludes with an exploration of the potential reasons for these leaks, alongside some recommendations for developers to protect their confidential information.