{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,12]],"date-time":"2026-06-12T17:01:08Z","timestamp":1781283668529,"version":"3.54.1"},"publisher-location":"New York, NY, USA","reference-count":25,"publisher":"ACM","funder":[{"name":"Federal Ministry of Research, Technology and Space","award":["16KIS1956"],"award-info":[{"award-number":["16KIS1956"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2026,6,23]]},"DOI":"10.1145\/3806007.3810969","type":"proceedings-article","created":{"date-parts":[[2026,6,12]],"date-time":"2026-06-12T16:29:17Z","timestamp":1781281757000},"page":"29-39","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["When Documented APIs Expose Identifiers: Measuring Unauthenticated SSH Key Metadata in Self-Managed GitLab"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0005-7046-7698","authenticated-orcid":false,"given":"Philipp","family":"Schubaur","sequence":"first","affiliation":[{"name":"Technical University of Applied Sciences Augsburg, Augsburg, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-9849-876X","authenticated-orcid":false,"given":"Peter","family":"Knauer","sequence":"additional","affiliation":[{"name":"Technical University of Applied Sciences Augsburg, Augsburg, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-2272-1147","authenticated-orcid":false,"given":"Philipp","family":"Schloyer","sequence":"additional","affiliation":[{"name":"Technical University of Applied Sciences Augsburg, Augsburg, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2310-5895","authenticated-orcid":false,"given":"Dominik","family":"Merli","sequence":"additional","affiliation":[{"name":"Technical University of Applied Sciences Augsburg, Augsburg, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,6,22]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-024-10544-7"},{"key":"e_1_3_2_1_2_1","unstructured":"Jake Baines. 2022. CVE-2021-4191: GitLab GraphQL API User Enumeration Fixed. https:\/\/www.rapid7.com\/blog\/post\/2022\/03\/03\/cve-2021-4191-gitlab-graphql-api-user-enumeration-fixed\/. Accessed: 2025-06-24."},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/3719027.3765079"},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1111\/2041-210x.14108"},{"key":"e_1_3_2_1_5_1","unstructured":"Scott de Jonge. 2024. Replace text-muted Class with gl-text-subtle. https:\/\/gitlab.com\/gitlab-org\/gitlab\/-\/blame\/master\/app\/views\/user_settings\/ssh_keys\/_form.html.haml#L14. Accessed: 2025-07-06."},{"key":"e_1_3_2_1_6_1","volume-title":"Stack Overflow Developer Survey","author":"Team Developer Survey","year":"2022","unstructured":"Developer Survey Team. 2022. Stack Overflow Developer Survey 2022. https:\/\/survey.stackoverflow.co\/2022. Accessed: 2025-06-27."},{"key":"e_1_3_2_1_7_1","unstructured":"Imre Farkas. 2022. Unauthenticated User Enumeration via GitLab GraphQL API (CVE-2021-4191). https:\/\/gitlab.com\/gitlab-org\/gitlab\/-\/issues\/354209. Accessed: 2025-07-11."},{"key":"e_1_3_2_1_8_1","unstructured":"GitLab Inc. 2025. GitLab. https:\/\/gitlab.com. Accessed: 2025-07-11."},{"key":"e_1_3_2_1_9_1","volume-title":"33rd USENIX Security Symposium (USENIX Security 24)","author":"Gr\u00f6ber Lea","unstructured":"Lea Gr\u00f6ber, Simon Lenau, Rebecca Weil, Elena Groben, Michael Schilling, and Katharina Krombholz. 2024. Towards Privacy and Security in Private Clouds: A Representative Survey on the Prevalence of Private Hosting and Administrator Characteristics. https:\/\/www.usenix.org\/conference\/usenixsecurity24\/presentation\/grober-private-clouds. In 33rd USENIX Security Symposium (USENIX Security 24). USENIX Association, Philadelphia, PA, 6057-6074."},{"key":"e_1_3_2_1_10_1","first-page":"2491","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Gr\u00f6ber Lea","year":"2023","unstructured":"Lea Gr\u00f6ber, Rafael Mrowczynski, Nimisha Vijay, Daphne A. Muller, Adrian Dabrowski, and Katharina Krombholz. 2023. To Cloud or Not to Cloud: A Qualitative Study on Self-Hosters' Motivation, Operation, and Security Mindset. https:\/\/www.usenix.org\/conference\/usenixsecurity23\/presentation\/grober. In 32nd USENIX Security Symposium (USENIX Security 23). 2491-2508."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/3517745.3561446"},{"key":"e_1_3_2_1_12_1","unstructured":"Ashraf Khamis. 2025. GitLab Omnibus NGINX Settings. https:\/\/docs.gitlab.com\/omnibus\/settings\/nginx. Accessed: 2025-06-04."},{"key":"e_1_3_2_1_13_1","unstructured":"Sincheol (David) Kim. 2018. GitLab Issue #25953. https:\/\/gitlab.com\/gitlab-org\/gitlab\/-\/issues\/25953. Accessed: 2025-06-18."},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","unstructured":"David Knothe and Frederick Pietschmann. 2019. Large-Scale Exploit of GitHub Repository Metadata and Preventive Measures. doi:10.48550\/arXiv.1908.05354 arXiv:1908.05354","DOI":"10.48550\/arXiv.1908.05354"},{"key":"e_1_3_2_1_15_1","unstructured":"Thong Kuah. 2020. GitLab Issue #216456. https:\/\/gitlab.com\/gitlab-org\/gitlab\/-\/issues\/216456. Accessed: 2025-07-11."},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/MS.2010.39"},{"key":"e_1_3_2_1_17_1","unstructured":"Paulius Laurinavicius. 2025. Terraform Provider for GitLab Issue #338. https:\/\/gitlab.com\/gitlab-org\/terraform-provider-gitlab\/-\/issues\/338. Accessed: 2025-07-11."},{"key":"e_1_3_2_1_18_1","unstructured":"Francisco Javier L\u00f3pez. 2017. GitLab Issue #36819. https:\/\/gitlab.com\/gitlab-org\/gitlab-foss\/-\/issues\/36819. Accessed: 2025-07-10."},{"key":"e_1_3_2_1_19_1","unstructured":"Manoj M J. 2020. GitLab Issue #220185. https:\/\/gitlab.com\/gitlab-org\/gitlab\/-\/issues\/220185. Accessed: 2025-07-11."},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23418"},{"key":"e_1_3_2_1_21_1","unstructured":"Fabio Pitino. 2022. GitLab Epic #8115. https:\/\/gitlab.com\/groups\/gitlab-org\/-\/epics\/8115. Accessed: 2025-07-11."},{"key":"e_1_3_2_1_22_1","unstructured":"Raspberry Pi Foundation. 2025. Raspberry Pi Software. https:\/\/www.raspberrypi.com\/software\/. Accessed: 2025-05-24."},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.51983\/ajeat-2023.12.2.3969"},{"key":"e_1_3_2_1_24_1","unstructured":"Marcin Sedlak-Jakubowski. 2025. Rate Limits on Users API. https:\/\/docs.gitlab.com\/administration\/settings\/rate_limit_on_users_api\/. Accessed: 2025-12-17."},{"key":"e_1_3_2_1_25_1","volume-title":"Statistics Division","author":"United Nations","year":"2025","unstructured":"United Nations, Statistics Division. 2025. Western Europe (UN M49 Geographical Subregion). https:\/\/unstats.un.org\/unsd\/methodology\/m49\/. Accessed: 2025-05-13."}],"event":{"name":"CODASPY '26: Sixteenth ACM Conference on Data and Application Security and Privacy","location":"Frankfurt am Main Germany","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 12th ACM International Workshop on Security and Privacy Analytics"],"original-title":[],"deposited":{"date-parts":[[2026,6,12]],"date-time":"2026-06-12T16:29:59Z","timestamp":1781281799000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3806007.3810969"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6,22]]},"references-count":25,"alternative-id":["10.1145\/3806007.3810969","10.1145\/3806007"],"URL":"https:\/\/doi.org\/10.1145\/3806007.3810969","relation":{},"subject":[],"published":{"date-parts":[[2026,6,22]]},"assertion":[{"value":"2026-06-22","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}