IssueGuard: Real-Time Secret Leak Prevention Tool for GitHub Issue Reports

2026-02-08

AI Summary

This study addresses the prevalent issue of accidental leakage of sensitive information—such as API keys—in GitHub and GitLab issue reports, often caused by users inadvertently pasting log files or code snippets. Current platforms lack real-time warnings prior to submission, leaving such exposures undetected. To mitigate this risk, this work proposes the first Chrome extension integrating a context-aware deep learning model that dynamically scans issue content during editing for potential secret leaks. The approach combines regular expression-based candidate extraction with a fine-tuned CodeBERT model to achieve high-precision detection and interactive user alerts. Evaluated on a benchmark dataset, the system attains an F1 score of 92.70%, substantially outperforming conventional regex-based scanning tools. The implementation, along with a demonstration video, is publicly released to foster further research and adoption.

Technology Category

• Natural Language Processing: Fact-Checking / Misinformation Detection (NLP Focus)
• Machine Learning: Large Multimodal Models (LMMs)
• Computer Vision: Large Vision Models

Application Category

• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Web Mining and Content Analysis: Large pretrained models with web data
• Security and Privacy: Large-scale security measurements

Abstract

GitHub and GitLab are widely used collaborative platforms whose issue-tracking systems contain large volumes of unstructured text, including logs, code snippets, and configuration examples. This creates a significant risk of accidental secret exposure, such as API keys and credentials, yet these platforms provide no mechanism to warn users before submission. We present \textsc{IssueGuard}, a tool for real-time detection and prevention of secret leaks in issue reports. Implemented as a Chrome extension, \textsc{IssueGuard} analyzes text as users type and combines regex-based candidate extraction with a fine-tuned CodeBERT model for contextual classification. This approach effectively separates real secrets from false positives and achieves an F1-score of 92.70\% on a benchmark dataset, outperforming traditional regex-based scanners. \textsc{IssueGuard} integrates directly into the web interface and continuously analyzes the issue editor, presenting clear visual warnings to help users avoid submitting sensitive data. The source code is publicly available at \href{https://github.com/nafiurahman00/IssueGuard}{https://github.com/nafiurahman00/IssueGuard}, and a demonstration video is available at \href{https://youtu.be/kvbWA8rr9cU}{https://youtu.be/kvbWA8rr9cU}.

Problem

• secret leak
• GitHub issues
• sensitive data exposure
• API keys
• credential leakage

Innovation

• real-time secret detection
• CodeBERT fine-tuning
• context-aware classification
• browser extension
• false positive reduction