{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2022:IJPQ2KAOEKL47SJI5WMI742NPE","short_pith_number":"pith:IJPQ2KAO","canonical_record":{"source":{"id":"2208.11280","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2022-08-24T02:50:32Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"5975f3c8a7a1e37c627f65ccdf7d6036ef54d999f8fcfca001296f527e605b4a","abstract_canon_sha256":"8721371ac6b30ed17fcf4b971ee9f59449dfbd1698f237e50f49a8123634a356"},"schema_version":"1.0"},"canonical_sha256":"425f0d280e2297cfc928ed988ff34d793267e58bac42cc85301a4d46c4432707","source":{"kind":"arxiv","id":"2208.11280","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2208.11280","created_at":"2026-07-05T04:51:13Z"},{"alias_kind":"arxiv_version","alias_value":"2208.11280v1","created_at":"2026-07-05T04:51:13Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2208.11280","created_at":"2026-07-05T04:51:13Z"},{"alias_kind":"pith_short_12","alias_value":"IJPQ2KAOEKL4","created_at":"2026-07-05T04:51:13Z"},{"alias_kind":"pith_short_16","alias_value":"IJPQ2KAOEKL47SJI","created_at":"2026-07-05T04:51:13Z"},{"alias_kind":"pith_short_8","alias_value":"IJPQ2KAO","created_at":"2026-07-05T04:51:13Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2022:IJPQ2KAOEKL47SJI5WMI742NPE","target":"record","payload":{"canonical_record":{"source":{"id":"2208.11280","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2022-08-24T02:50:32Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"5975f3c8a7a1e37c627f65ccdf7d6036ef54d999f8fcfca001296f527e605b4a","abstract_canon_sha256":"8721371ac6b30ed17fcf4b971ee9f59449dfbd1698f237e50f49a8123634a356"},"schema_version":"1.0"},"canonical_sha256":"425f0d280e2297cfc928ed988ff34d793267e58bac42cc85301a4d46c4432707","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T04:51:13.314844Z","signature_b64":"mx3jfDtT2jyIIPVg+1V0j3j2xnN7GfYU+KIyECgDd6icJfd782vKhWD975VXNw7fQkUA4OJTxU4scLGCfZXACA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"425f0d280e2297cfc928ed988ff34d793267e58bac42cc85301a4d46c4432707","last_reissued_at":"2026-07-05T04:51:13.314365Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T04:51:13.314365Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2208.11280","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T04:51:13Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"bQ5TziMuQtAZDVQjkzWUJ1+qedAGK//yGyHP2rJV9/Qd4V4cuN1fyakglDocV9GRV3iR1QOheAt++NRKsGfoDw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-17T20:01:38.442942Z"},"content_sha256":"efbd430387fc09e1e715491227b3c9a70e2cb6066b4410af4aa5e2e94a244575","schema_version":"1.0","event_id":"sha256:efbd430387fc09e1e715491227b3c9a70e2cb6066b4410af4aa5e2e94a244575"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2022:IJPQ2KAOEKL47SJI5WMI742NPE","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"What are the Practices for Secret Management in Software Artifacts?","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.CR"],"primary_cat":"cs.SE","authors_text":"Bradley Reaves, Laurie Williams, Lorenzo Neil, Setu Kumar Basak","submitted_at":"2022-08-24T02:50:32Z","abstract_excerpt":"Throughout 2021, GitGuardian's monitoring of public GitHub repositories revealed a two-fold increase in the number of secrets (database credentials, API keys, and other credentials) exposed compared to 2020, accumulating more than six million secrets. A systematic derivation of practices for managing secrets can help practitioners in secure development. The goal of our paper is to aid practitioners in avoiding the exposure of secrets by identifying secret management practices in software artifacts through a systematic derivation of practices disseminated in Internet artifacts. We conduct a gre"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2208.11280","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2208.11280/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T04:51:13Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"wE/MIZ+EDjuLVWY5k2T9Asbneb/YehJv54BTsu0lvXV2HTApB+bPsmYI1YI2BkbJLxaSZG2sGwaFL98kMDDDCg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-17T20:01:38.443322Z"},"content_sha256":"d37b4aac9e392a14ff2ba71b02eba6da6083f139e33fe55ce9d234fa7773ca6c","schema_version":"1.0","event_id":"sha256:d37b4aac9e392a14ff2ba71b02eba6da6083f139e33fe55ce9d234fa7773ca6c"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/IJPQ2KAOEKL47SJI5WMI742NPE/bundle.json","state_url":"https://pith.science/pith/IJPQ2KAOEKL47SJI5WMI742NPE/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/IJPQ2KAOEKL47SJI5WMI742NPE/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-17T20:01:38Z","links":{"resolver":"https://pith.science/pith/IJPQ2KAOEKL47SJI5WMI742NPE","bundle":"https://pith.science/pith/IJPQ2KAOEKL47SJI5WMI742NPE/bundle.json","state":"https://pith.science/pith/IJPQ2KAOEKL47SJI5WMI742NPE/state.json","well_known_bundle":"https://pith.science/.well-known/pith/IJPQ2KAOEKL47SJI5WMI742NPE/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2022:IJPQ2KAOEKL47SJI5WMI742NPE","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"8721371ac6b30ed17fcf4b971ee9f59449dfbd1698f237e50f49a8123634a356","cross_cats_sorted":["cs.CR"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2022-08-24T02:50:32Z","title_canon_sha256":"5975f3c8a7a1e37c627f65ccdf7d6036ef54d999f8fcfca001296f527e605b4a"},"schema_version":"1.0","source":{"id":"2208.11280","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2208.11280","created_at":"2026-07-05T04:51:13Z"},{"alias_kind":"arxiv_version","alias_value":"2208.11280v1","created_at":"2026-07-05T04:51:13Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2208.11280","created_at":"2026-07-05T04:51:13Z"},{"alias_kind":"pith_short_12","alias_value":"IJPQ2KAOEKL4","created_at":"2026-07-05T04:51:13Z"},{"alias_kind":"pith_short_16","alias_value":"IJPQ2KAOEKL47SJI","created_at":"2026-07-05T04:51:13Z"},{"alias_kind":"pith_short_8","alias_value":"IJPQ2KAO","created_at":"2026-07-05T04:51:13Z"}],"graph_snapshots":[{"event_id":"sha256:d37b4aac9e392a14ff2ba71b02eba6da6083f139e33fe55ce9d234fa7773ca6c","target":"graph","created_at":"2026-07-05T04:51:13Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2208.11280/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Throughout 2021, GitGuardian's monitoring of public GitHub repositories revealed a two-fold increase in the number of secrets (database credentials, API keys, and other credentials) exposed compared to 2020, accumulating more than six million secrets. A systematic derivation of practices for managing secrets can help practitioners in secure development. The goal of our paper is to aid practitioners in avoiding the exposure of secrets by identifying secret management practices in software artifacts through a systematic derivation of practices disseminated in Internet artifacts. We conduct a gre","authors_text":"Bradley Reaves, Laurie Williams, Lorenzo Neil, Setu Kumar Basak","cross_cats":["cs.CR"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2022-08-24T02:50:32Z","title":"What are the Practices for Secret Management in Software Artifacts?"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2208.11280","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:efbd430387fc09e1e715491227b3c9a70e2cb6066b4410af4aa5e2e94a244575","target":"record","created_at":"2026-07-05T04:51:13Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"8721371ac6b30ed17fcf4b971ee9f59449dfbd1698f237e50f49a8123634a356","cross_cats_sorted":["cs.CR"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2022-08-24T02:50:32Z","title_canon_sha256":"5975f3c8a7a1e37c627f65ccdf7d6036ef54d999f8fcfca001296f527e605b4a"},"schema_version":"1.0","source":{"id":"2208.11280","kind":"arxiv","version":1}},"canonical_sha256":"425f0d280e2297cfc928ed988ff34d793267e58bac42cc85301a4d46c4432707","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"425f0d280e2297cfc928ed988ff34d793267e58bac42cc85301a4d46c4432707","first_computed_at":"2026-07-05T04:51:13.314365Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T04:51:13.314365Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"mx3jfDtT2jyIIPVg+1V0j3j2xnN7GfYU+KIyECgDd6icJfd782vKhWD975VXNw7fQkUA4OJTxU4scLGCfZXACA==","signature_status":"signed_v1","signed_at":"2026-07-05T04:51:13.314844Z","signed_message":"canonical_sha256_bytes"},"source_id":"2208.11280","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:efbd430387fc09e1e715491227b3c9a70e2cb6066b4410af4aa5e2e94a244575","sha256:d37b4aac9e392a14ff2ba71b02eba6da6083f139e33fe55ce9d234fa7773ca6c"],"state_sha256":"6e5bafc3825c3f02c5d9af5804b4c1aa42adb7dc63d8ab1d03568f5378eb174b"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"XSJnfIZY5FACKQ0Uc39uTXQDq413E9+MfQCLIDCiv7G71isIHDTJ3LwYdtq238d6Xwlhw2dgCHTOqxuunFguAQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-17T20:01:38.445814Z","bundle_sha256":"229b391980a881c4b2c183709672a768e5f8421449f0d269b6a16471f33e7a43"}}