Code Audit & Software Supply Chain Security
Problem Statement
Developers accidentally commit hardcoded API keys, private RSA keys, or database credentials into source code repositories. Simple regex secret scanners struggle with high false-positive rates on high-entropy random test hashes.
Goal
Deploy an agent that validates detected secrets, distinguishes real production credentials from test hashes, and initiates automated token rotation.
Outcome Measurement
- False Positive Reduction: 90% reduction in false-positive secret alerts compared to standard
regextools. - Exposure Window: Secret exposure time reduced to < 30 seconds via automated API token revocation.
How the Code was Built
Evaluates secret context, checks string entropy, and infers if key signatures match active vendor API schemes.
Executable Code
from pydantic import BaseModel, Fieldfrom langchain_openai import ChatOpenAIclass SecretValidation(BaseModel): detected_secret_type: str is_real_credential: bool confidence_score: float recommended_mitigation: strdef analyze_committed_secret(code_snippet: str, file_path: str) -> SecretValidation: llm = ChatOpenAI(model="gpt-4o", temperature=0) structured_llm = llm.with_structured_output(SecretValidation) prompt = f"""Analyze code commit snippet for leaked hardcoded credentials in file '{file_path}':{code_snippet}Distinguish between dummy test keys, placeholder variables, and valid production API keys/credentials.""" return structured_llm.invoke(prompt)if __name__ == "__main__": snippet = "const AWS_SECRET = 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY';" res = analyze_committed_secret(snippet, "src/config/aws.js") print(f"Secret Type: {res.detected_secret_type}") print(f"Is Real Credential: {res.is_real_credential}") print(f"Mitigation: {res.recommended_mitigation}")
Leave a Reply