{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,12]],"date-time":"2026-09-12T01:54:15Z","timestamp":1789178055764,"version":"build-2803163510"},"reference-count":17,"publisher":"Springer Science and Business Media LLC","issue":"3","license":[{"start":{"date-parts":[[2022,3,17]],"date-time":"2022-03-17T00:00:00Z","timestamp":1647475200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2022,3,17]],"date-time":"2022-03-17T00:00:00Z","timestamp":1647475200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"funder":[{"name":"National Security Agency (US) Science of Security Lablet"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Empir Software Eng"],"published-print":{"date-parts":[[2022,5]]},"DOI":"10.1007\/s10664-021-10109-y","type":"journal-article","created":{"date-parts":[[2022,3,17]],"date-time":"2022-03-17T11:27:09Z","timestamp":1647516429000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":13,"title":["Why secret detection tools are not enough: It\u2019s not just about false positives - An industrial case study"],"prefix":"10.1007","volume":"27","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-4980-7350","authenticated-orcid":false,"given":"Md Rayhanur","family":"Rahman","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Nasif","family":"Imtiaz","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Margaret-Anne","family":"Storey","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Laurie","family":"Williams","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2022,3,17]]},"reference":[{"key":"10109_CR1","unstructured":"Amazon (2020) Aws key management service https:\/\/aws.amazon.com\/kms\/"},{"key":"10109_CR2","unstructured":"MITRE (2020) Cwe-798: Use of hard-coded credentials. https:\/\/cwe.mitre.org\/data\/definitions\/798.html Accessed 16 Sep 2020"},{"key":"10109_CR3","doi-asserted-by":"crossref","unstructured":"Meli M, McNiece M, Reaves B (2019) How bad can it git? characterizing secret leakage in public github repositories Networked and Distributed Systems Security Symposium (NDSS)","DOI":"10.14722\/ndss.2019.23418"},{"key":"10109_CR4","unstructured":"Montalbano E (2020) Medical data leaked on github due to developer errors. https:\/\/threatpost.com\/medical-data-leaked-on-github-due-to-developer-errors\/158653\/, Accessed 16 Sep 2020"},{"key":"10109_CR5","unstructured":"Ilascu I (2020) Starbucks devs leave api key in github public repo. https:\/\/www.bleepingcomputer.com\/news\/security\/starbucks-devs-leave-api-key-in-github-public-repo\/, Accessed 16 Sep 2020,"},{"key":"10109_CR6","unstructured":"Kumar V (2020) Jumpcloud api key leaked via open github repository. https:\/\/hackerone.com\/reports\/716292, Accessed 16 Sep 2020"},{"key":"10109_CR7","doi-asserted-by":"crossref","unstructured":"Rahman A, Parnin C, Williams L (2019) The seven sins: Security smells in infrastructure as code scripts. In: 2019 IEEE\/ACM 41St international conference on software engineering (ICSE), pp 164\u2013175","DOI":"10.1109\/ICSE.2019.00033"},{"key":"10109_CR8","doi-asserted-by":"crossref","unstructured":"Rahman A, Rahman MdR, Parnin C, Williams L (2020) Security smells in ansible and chef scripts: A replication study. ACM Transaction of Software Engineering and Methodology","DOI":"10.1145\/3408897"},{"key":"10109_CR9","doi-asserted-by":"crossref","unstructured":"Rahman MdR, Rahman A, Williams L (2019) Share, but be aware: Security smells in python gists. In: 2019 IEEE International conference on software maintenance and evolution (ICSME), pages 536\u2013540","DOI":"10.1109\/ICSME.2019.00087"},{"key":"10109_CR10","doi-asserted-by":"crossref","unstructured":"Saha A, Denning T, Srikumar V, Kasera SK (2020) Secrets in source code: Reducing false positives using machine learning. In: International conference on COMmunication systems NETworks (COMSNETS), pp 168\u2013175","DOI":"10.1109\/COMSNETS48256.2020.9027350"},{"key":"10109_CR11","doi-asserted-by":"crossref","unstructured":"Sinha VS, Saha D, Dhoolia P, Padhye R, Mani S (2015) Detecting and mitigating secret-key leaks in source code repositories. In: 2015 IEEE\/ACM 12Th working conference on mining software repositories, pp 396\u2013400","DOI":"10.1109\/MSR.2015.48"},{"key":"10109_CR12","unstructured":"Ding ZY, Khakshoor B, Paglierani J, Rajpal M (2020) Sniffing for codebase secret leaks with known production secrets in industry"},{"issue":"1","key":"10109_CR13","doi-asserted-by":"publisher","first-page":"221","DOI":"10.1145\/2637364.2592003","volume":"42","author":"N Viennot","year":"2014","unstructured":"Viennot N, Garcia E, Nieh J (2014) A measurement study of google play. SIGMETRICS Perform Eval Rev 42(1):221\u2013233","journal-title":"SIGMETRICS Perform Eval Rev"},{"key":"10109_CR14","doi-asserted-by":"crossref","unstructured":"Bunyakiati P, Sammapun U (2019) On secret management and handling in mobile application development life cycle: a position paper. In: 2019 34Th IEEE\/ACM international conference on automated software engineering workshop (ASEW), pp 77\u201380","DOI":"10.1109\/ASEW.2019.00033"},{"key":"10109_CR15","doi-asserted-by":"crossref","unstructured":"Johnson B, Pandita R, Smith J, Ford D, Elder S, Murphy-Hill E, Heckman S, Sadowski C (2016) A cross-tool communication study on program analysis tool notifications. In: ACM SIGSOFT International symposium on foundations of software engineering, pp 73\u201384","DOI":"10.1145\/2950290.2950304"},{"issue":"1","key":"10109_CR16","doi-asserted-by":"publisher","first-page":"11","DOI":"10.1080\/00401706.1986.10488093","volume":"28","author":"GEP Box","year":"1986","unstructured":"Box GEP, Daniel Meyer R (1986) An analysis for unreplicated fractional factorials. Technometrics 28(1):11\u201318","journal-title":"Technometrics"},{"key":"10109_CR17","unstructured":"Wikipedia (2021) Covid-19 pandemic https:\/\/en.wikipedia.org\/wiki\/COVID-19_pandemic"}],"container-title":["Empirical Software Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10664-021-10109-y.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10664-021-10109-y\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10664-021-10109-y.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,4,8]],"date-time":"2025-04-08T19:33:04Z","timestamp":1744140784000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10664-021-10109-y"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,3,17]]},"references-count":17,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2022,5]]}},"alternative-id":["10109"],"URL":"https:\/\/doi.org\/10.1007\/s10664-021-10109-y","relation":{},"ISSN":["1382-3256","1573-7616"],"issn-type":[{"value":"1382-3256","type":"print"},{"value":"1573-7616","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,3,17]]},"assertion":[{"value":"13 December 2021","order":1,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"17 March 2022","order":2,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"N\/A","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"<!--Emphasis Type='Bold' removed-->Conflict of Interests"}}],"article-number":"59"}}