ARMOR: A Five-State Active Validation Framework for Leaked Credentials in DevSecOps Pipelines
Article Sidebar
Main Article Content
Abstract
Credentials committed to source-code repositories are a persistent software supply-chain risk: a large-scale study of over 2.3 billion GitHub files found leakage across more than 100,000 repositories, with thousands of new secrets exposed daily. Academic detection research, however, systematically stops short of establishing whether a discovered credential is still live. This is not an oversight but a stated constraint: the two largest measurement studies in the field both record that they deliberately did not test the secrets they found, for ethical reasons, and therefore cannot report exploitability. The result is a detector–validator gap that leaves incident responders to arbitrate liveness by hand. This paper presents Armor, a credential-validation framework that addresses the gap by issuing minimal, read-only probe requests against official provider authentication endpoints for seventeen credential types spanning cloud, developer, communication, AI/ML, payment, and token-standard services. Armor's contribution is not detection breadth but verdict semantics and reproducibility: a five-state verdict alphabet-valid, invalid, nopermission, failedvalidation, invalidjwt-enforced as a typed return contract by an abstract base class, so that a credential which authenticates but lacks scope is reported distinctly from one that is rejected outright. The framework is organised as a five-layer pipeline and is extended by an LLM triage agent that recovers credentials from unstructured incident text. Measured on the v1.0.0 codebase, a suite of 126 unit tests executes in 0.22 s, and all nineteen deterministic validator modules hold 100% branch coverage under a fail-under gate; the LLM agent module, which requires live network access, is not covered, giving 93.55% overall. Comparison against contemporary tools shows that active verification is now established industrial practice, and positions Armor's normalised verdict schema and coverage-gated validator layer-rather than provider count-as its contribution.
Keywords: active credential validation; secret leakage; DevSecOps; secret scanning; API authentication; software supply-chain security; verdict normalisation; large language models.
Article Details
Section
How to Cite
References
Federal Trade Commission. (2018). FTC addresses Uber's undisclosed data breach in new proposed order. https://www.ftc.gov/business-guidance/blog/2018/04/ftc-addresses-ubers-undisclosed-data-breach-new-proposed-order
RedHunt Labs. (2024). Mercedes-Benz source code at risk: GitHub token mishap sparks major security concerns. https://redhuntlabs.com/blog/mercedes-benz-source-code-at-risk-github-token-mishap-sparks-major-security-concerns/
Meli, M., McNiece, M. R., & Reaves, B. (2019). How bad can it git? Characterizing secret leakage in public GitHub repositories. In Proceedings of the Network and Distributed System Security Symposium (NDSS). https://www.ndss-symposium.org/ndss-paper/how-bad-can-it-git-characterizing-secret-leakage-in-public-github-repositories/
Zhou, J., Zhang, Z., Ying, L., Chai, H., Cao, J., & Duan, H. (2025). Hey, your secrets leaked! Detecting and characterizing secret leakage in the wild. In Proceedings of the IEEE Symposium on Security and Privacy (SP) (pp. 449–467). https://doi.org/10.1109/SP61157.2025.00122
Sinha, V. S., Saha, D., Dhoolia, P., Parate, R., & Nanda, M. G. (2015). Detecting and mitigating secret-key leaks in source code repositories. In Proceedings of the IEEE/ACM 12th Working Conference on Mining Software Repositories (MSR) (pp. 396–400). https://doi.org/10.1109/MSR.2015.48
Saha, A., Denning, T., Srikumar, V., & Kasera, S. K. (2020). Secrets in source code: Reducing false positives using machine learning. In Proceedings of the International Conference on COMmunication Systems & NETworkS (COMSNETS) (pp. 168–175). https://doi.org/10.1109/COMSNETS48256.2020.9027350
Han, R., Gong, H., Ma, S., Li, J., Xu, C., Bertino, E., Nepal, S., Ma, Z., & Ma, J. (2024). A credential usage study: Flow-aware leakage detection in open-source projects. IEEE Transactions on Information Forensics and Security, 19, 722–734. https://doi.org/10.1109/TIFS.2023.3326985
Alecci, M., Samhi, J., Bissyandé, T. F., & Klein, J. (2025). Evaluating large language models in detecting secrets in Android apps (arXiv:2510.18601). arXiv. https://arxiv.org/abs/2510.18601
Li, K., Ling, L., Yang, J., & Wei, L. (2026). Automatically detecting checked-in secrets in Android apps: How far are we? Empirical Software Engineering, 31. https://doi.org/10.1007/s10664-025-10772-5
Truffle Security Co. (2025). TruffleHog: Find, verify, and analyze leaked credentials. https://github.com/trufflesecurity/trufflehog
GitHub Inc. (2025). Enabling validity checks for your repository - secret scanning. GitHub Docs. https://docs.github.com/en/code-security/secret-scanning/enabling-secret-scanning-features/enabling-validity-checks-for-your-repository
Gitleaks. (2025). Gitleaks: Find secrets, stop leaks, secure your code. https://gitleaks.io
Sinan, M., Shahin, M., & Gondal, I. (2025). Integrating security controls in DevSecOps: Challenges, solutions, and future research directions. Journal of Software: Evolution and Process, 37(6). https://doi.org/10.1002/smr.70029
Yelkoti, N. K. K. R. (2025). Security as code: An architectural framework for automated risk mitigation in DevSecOps pipelines. Journal of Computer Science and Technology Studies, 7(6), 235–244.
Chornii, V., Martseniuk, Y., Partyka, A., & Harasymchuk, O. (2025). Information security risks associated with the uncontrolled storage of secrets in source code. In Proceedings of Cyber Security and Data Protection (CSDP). CEUR Workshop Proceedings, 4042, 250–271. https://ceur-ws.org/Vol-4042/
Soni, L. N., Gautam, C. S., & Pandey, P. (2022). Clustering of Bigdata Using Genetic Algorithm in Hadoop Map Reduce. European Chemical Bulletin, 963–973.
Mousavi, Z., Islam, C., Babar, M. A., & Abuadbba, A. (2025). Detecting misuse of security APIs: A systematic review. ACM Computing Surveys, 57(8), 1–39. https://doi.org/10.1145/3735968
Reddy, D. B. L. L., Sumathi, Soni, L. N., M. R., & Nanthini, P. (2025). Deep Learning Algorithm For Sentiment Analysis Of E-Commerce. International Journal of Novel Research And Development (IJNRD), 10(5).
P. Bhartiya, M. Bhatele, and A. A. Waoo, "Ensemble-Based Machine Learning Models for Real-Time Traffic Flow Prediction," Journal of Neonatal Surgery, vol. 14, no. 32s, pp. 6406-6419, 2025.
OWASP Foundation. (2021). A07:2021 - Identification and authentication failures. OWASP Top 10:2021. https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/
National Institute of Standards and Technology. (2017). Digital identity guidelines: Authentication and lifecycle management (NIST Special Publication 800-63B). https://doi.org/10.6028/NIST.SP.800-63b
Ramírez, S. (2025). Typer: Build great CLIs with Python. https://typer.tiangolo.com
Colvin, S., & the Pydantic contributors. (2025). Pydantic: Data validation using Python type hints. https://docs.pydantic.dev
Amazon Web Services. (2025). GetCallerIdentity - AWS Security Token Service API reference. https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html
Microsoft Corporation. (2025). Microsoft identity platform and the OAuth 2.0 client credentials flow. https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-client-creds-grant-flow
Meta AI. (2024). Llama 3.3 70B model card. https://www.llama.com/models/llama-3-3/
GitHub Inc. (2025). GitHub REST API documentation. https://docs.github.com/rest