{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2023:PF7J65NKXRVHBHISSFQ4T44OCI","short_pith_number":"pith:PF7J65NK","canonical_record":{"source":{"id":"2301.12377","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2023-01-29T06:47:27Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"ffcc4c8f9d37113a4fa3685849b90714de10853dce901a479d9989b2da45013a","abstract_canon_sha256":"74e2c07cd88c0c6f33d5e6f0f680474af0d0c3c9b41898e7b887b3f9d84c0097"},"schema_version":"1.0"},"canonical_sha256":"797e9f75aabc6a709d129161c9f38e1200e8ba39dcd3ddc6213a3e8fc0b14338","source":{"kind":"arxiv","id":"2301.12377","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2301.12377","created_at":"2026-07-05T05:36:38Z"},{"alias_kind":"arxiv_version","alias_value":"2301.12377v1","created_at":"2026-07-05T05:36:38Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2301.12377","created_at":"2026-07-05T05:36:38Z"},{"alias_kind":"pith_short_12","alias_value":"PF7J65NKXRVH","created_at":"2026-07-05T05:36:38Z"},{"alias_kind":"pith_short_16","alias_value":"PF7J65NKXRVHBHIS","created_at":"2026-07-05T05:36:38Z"},{"alias_kind":"pith_short_8","alias_value":"PF7J65NK","created_at":"2026-07-05T05:36:38Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2023:PF7J65NKXRVHBHISSFQ4T44OCI","target":"record","payload":{"canonical_record":{"source":{"id":"2301.12377","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2023-01-29T06:47:27Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"ffcc4c8f9d37113a4fa3685849b90714de10853dce901a479d9989b2da45013a","abstract_canon_sha256":"74e2c07cd88c0c6f33d5e6f0f680474af0d0c3c9b41898e7b887b3f9d84c0097"},"schema_version":"1.0"},"canonical_sha256":"797e9f75aabc6a709d129161c9f38e1200e8ba39dcd3ddc6213a3e8fc0b14338","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T05:36:38.641382Z","signature_b64":"1GGRFUiORTYxRQYaYQl87KLxI92KrZSMu0UHAOfG2TcSyYoaSH+9rr7Ow9DVtk6clzRKG4njTOtjsIsJQSALDg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"797e9f75aabc6a709d129161c9f38e1200e8ba39dcd3ddc6213a3e8fc0b14338","last_reissued_at":"2026-07-05T05:36:38.640918Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T05:36:38.640918Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2301.12377","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T05:36:38Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"8dmrKzVhKBZ4WZUaasKGKNjJNRh5baTuvpwAY8u2KsESWMk3m/HfhiT1q0175zdaudgIHmYAQu3xJJBHtb7jBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T13:53:13.507557Z"},"content_sha256":"687c8f971b8c64e6cba6ef410fac5fb3af09927020be08dab2fba8dcf109bdfb","schema_version":"1.0","event_id":"sha256:687c8f971b8c64e6cba6ef410fac5fb3af09927020be08dab2fba8dcf109bdfb"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2023:PF7J65NKXRVHBHISSFQ4T44OCI","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"What Challenges Do Developers Face About Checked-in Secrets in Software Artifacts?","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.CR"],"primary_cat":"cs.SE","authors_text":"Bradley Reaves, Laurie Williams, Lorenzo Neil, Setu Kumar Basak","submitted_at":"2023-01-29T06:47:27Z","abstract_excerpt":"Throughout 2021, GitGuardian's monitoring of public GitHub repositories revealed a two-fold increase in the number of secrets (database credentials, API keys, and other credentials) exposed compared to 2020, accumulating more than six million secrets. To our knowledge, the challenges developers face to avoid checked-in secrets are not yet characterized. The goal of our paper is to aid researchers and tool developers in understanding and prioritizing opportunities for future research and tool automation for mitigating checked-in secrets through an empirical investigation of challenges and solut"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2301.12377","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2301.12377/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T05:36:38Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"52bKOEHUUl9OlIDVIE2U6/JIhvAY6aHtobFdiDrkTuJTw/nBB3MawuMUCXhSc2Snf9D6PiXNvex3T5eg050VDw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T13:53:13.508088Z"},"content_sha256":"0f24adb0c7d54e688c1262199cfad7cc81cdf316ee28f8e511229d5d34c4d265","schema_version":"1.0","event_id":"sha256:0f24adb0c7d54e688c1262199cfad7cc81cdf316ee28f8e511229d5d34c4d265"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/PF7J65NKXRVHBHISSFQ4T44OCI/bundle.json","state_url":"https://pith.science/pith/PF7J65NKXRVHBHISSFQ4T44OCI/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/PF7J65NKXRVHBHISSFQ4T44OCI/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-07T13:53:13Z","links":{"resolver":"https://pith.science/pith/PF7J65NKXRVHBHISSFQ4T44OCI","bundle":"https://pith.science/pith/PF7J65NKXRVHBHISSFQ4T44OCI/bundle.json","state":"https://pith.science/pith/PF7J65NKXRVHBHISSFQ4T44OCI/state.json","well_known_bundle":"https://pith.science/.well-known/pith/PF7J65NKXRVHBHISSFQ4T44OCI/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2023:PF7J65NKXRVHBHISSFQ4T44OCI","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"74e2c07cd88c0c6f33d5e6f0f680474af0d0c3c9b41898e7b887b3f9d84c0097","cross_cats_sorted":["cs.CR"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2023-01-29T06:47:27Z","title_canon_sha256":"ffcc4c8f9d37113a4fa3685849b90714de10853dce901a479d9989b2da45013a"},"schema_version":"1.0","source":{"id":"2301.12377","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2301.12377","created_at":"2026-07-05T05:36:38Z"},{"alias_kind":"arxiv_version","alias_value":"2301.12377v1","created_at":"2026-07-05T05:36:38Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2301.12377","created_at":"2026-07-05T05:36:38Z"},{"alias_kind":"pith_short_12","alias_value":"PF7J65NKXRVH","created_at":"2026-07-05T05:36:38Z"},{"alias_kind":"pith_short_16","alias_value":"PF7J65NKXRVHBHIS","created_at":"2026-07-05T05:36:38Z"},{"alias_kind":"pith_short_8","alias_value":"PF7J65NK","created_at":"2026-07-05T05:36:38Z"}],"graph_snapshots":[{"event_id":"sha256:0f24adb0c7d54e688c1262199cfad7cc81cdf316ee28f8e511229d5d34c4d265","target":"graph","created_at":"2026-07-05T05:36:38Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2301.12377/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Throughout 2021, GitGuardian's monitoring of public GitHub repositories revealed a two-fold increase in the number of secrets (database credentials, API keys, and other credentials) exposed compared to 2020, accumulating more than six million secrets. To our knowledge, the challenges developers face to avoid checked-in secrets are not yet characterized. The goal of our paper is to aid researchers and tool developers in understanding and prioritizing opportunities for future research and tool automation for mitigating checked-in secrets through an empirical investigation of challenges and solut","authors_text":"Bradley Reaves, Laurie Williams, Lorenzo Neil, Setu Kumar Basak","cross_cats":["cs.CR"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2023-01-29T06:47:27Z","title":"What Challenges Do Developers Face About Checked-in Secrets in Software Artifacts?"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2301.12377","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:687c8f971b8c64e6cba6ef410fac5fb3af09927020be08dab2fba8dcf109bdfb","target":"record","created_at":"2026-07-05T05:36:38Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"74e2c07cd88c0c6f33d5e6f0f680474af0d0c3c9b41898e7b887b3f9d84c0097","cross_cats_sorted":["cs.CR"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2023-01-29T06:47:27Z","title_canon_sha256":"ffcc4c8f9d37113a4fa3685849b90714de10853dce901a479d9989b2da45013a"},"schema_version":"1.0","source":{"id":"2301.12377","kind":"arxiv","version":1}},"canonical_sha256":"797e9f75aabc6a709d129161c9f38e1200e8ba39dcd3ddc6213a3e8fc0b14338","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"797e9f75aabc6a709d129161c9f38e1200e8ba39dcd3ddc6213a3e8fc0b14338","first_computed_at":"2026-07-05T05:36:38.640918Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T05:36:38.640918Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"1GGRFUiORTYxRQYaYQl87KLxI92KrZSMu0UHAOfG2TcSyYoaSH+9rr7Ow9DVtk6clzRKG4njTOtjsIsJQSALDg==","signature_status":"signed_v1","signed_at":"2026-07-05T05:36:38.641382Z","signed_message":"canonical_sha256_bytes"},"source_id":"2301.12377","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:687c8f971b8c64e6cba6ef410fac5fb3af09927020be08dab2fba8dcf109bdfb","sha256:0f24adb0c7d54e688c1262199cfad7cc81cdf316ee28f8e511229d5d34c4d265"],"state_sha256":"6666aee4c118bcd747beccd2afd1372b1c603700700b19752b4b38793c891b6b"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"QYnWIqaCtQnlmM1Cuz6FSc/Paxn56u01xN+u/Vp8u5vmwqoypMB6mE/PKWQgPMHmqHT2UDCGwqQBEwnIpuVHBw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-07T13:53:13.510658Z","bundle_sha256":"e4ad6f1c4f8a124bee9d900ac387ecbb8bf735e392ae30d016fc687f1ab9f709"}}