安全团队终于有了能区分真实凭据和占位符的检测工具，误报率大幅降低。做DevSecOps的开发者可以直接参考这个框架来优化自己的凭据扫描流程。
针对公开代码仓库中凭据泄露检测高误报率问题，研究者提出一个三类分类框架，将占位符/弱凭据作为独立类别，结合CodeBERT语义理解与字符级模式识别。在包含10种编程语言的9426个样本数据集上，模型在真实凭据泄露检测上达到93%召回率和89%精确率，同时将高严重性告警减少33%。相比纯字符级方法，占位符/弱凭据检测F1从54%提升至81%，且跨语言泛化能力强，9/10语言在留一语言评估中F1超过0.80。
Separating Secrets from Placeholders: A Hybrid CNN-CodeBERT Framework for Three-Class Credential Leakage Detection
Credential leakage in public source code repositories poses a critical security threat, with over 23.8 million secrets exposed in 2024 alone. Existing detection tools suffer from high false-positive rates because rigid pattern matching and binary classification schemes fail to distinguish genuine credentials from placeholder or weak credentials. We propose a three-class classification framework that explicitly models placeholder or weak credentials as a distinct class, leveraging CodeBERT-based semantic understanding combined with character-level pattern recognition. We evaluate our approach on a newly constructed dataset of 9,426 samples spanning 10 programming languages. Our model achieves a Matthews Correlation Coefficient of 0.86 and a macro F1-score of 0.90, achieving 93% recall and 89% precision for genuine credential leaks while reducing high severity alerts by 33.0% (from 373 to 250) without sacrificing security coverage. Compared to prior character-level approaches, our method improves placeholder or weak credential detection from 54% to 81% F1-score while maintaining strong cross language generalization, with 9 of 10 languages achieving F1 above 0.80 under leave-one-language-out evaluation.