{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:S7OATB2RRCCYNL4UX5CKWD6FUW","short_pith_number":"pith:S7OATB2R","canonical_record":{"source":{"id":"2502.01020","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-02-03T03:32:12Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"33dd5434568c7736c7a31e3d6ad74113edb9f51a9a2dc6c172e9dc6cd1591bbb","abstract_canon_sha256":"bc823462b534161172a2872314f8aa71404b42576e4f7979172735bcc54e113e"},"schema_version":"1.0"},"canonical_sha256":"97dc098751888586af94bf44ab0fc5a587e04c145ad7e58bfebef38ab8addc93","source":{"kind":"arxiv","id":"2502.01020","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2502.01020","created_at":"2026-07-05T10:08:41Z"},{"alias_kind":"arxiv_version","alias_value":"2502.01020v1","created_at":"2026-07-05T10:08:41Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2502.01020","created_at":"2026-07-05T10:08:41Z"},{"alias_kind":"pith_short_12","alias_value":"S7OATB2RRCCY","created_at":"2026-07-05T10:08:41Z"},{"alias_kind":"pith_short_16","alias_value":"S7OATB2RRCCYNL4U","created_at":"2026-07-05T10:08:41Z"},{"alias_kind":"pith_short_8","alias_value":"S7OATB2R","created_at":"2026-07-05T10:08:41Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:S7OATB2RRCCYNL4UX5CKWD6FUW","target":"record","payload":{"canonical_record":{"source":{"id":"2502.01020","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-02-03T03:32:12Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"33dd5434568c7736c7a31e3d6ad74113edb9f51a9a2dc6c172e9dc6cd1591bbb","abstract_canon_sha256":"bc823462b534161172a2872314f8aa71404b42576e4f7979172735bcc54e113e"},"schema_version":"1.0"},"canonical_sha256":"97dc098751888586af94bf44ab0fc5a587e04c145ad7e58bfebef38ab8addc93","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T10:08:41.706057Z","signature_b64":"jF8/W8zqu6qh6hPzUDV5rZJKXl8lfMBHs7jX7Ox74k7QqcvhGUog6nTNBxxYaQXvSTjp5upGLiyyjYXtH+zDDA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"97dc098751888586af94bf44ab0fc5a587e04c145ad7e58bfebef38ab8addc93","last_reissued_at":"2026-07-05T10:08:41.705639Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T10:08:41.705639Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2502.01020","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:08:41Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"0QDkW9nQMj8+BLMSxpbYjUhmcUO8WaN95DtbEsQmfhkJ8Rlbh6c4SD0i7EDm4MsUtA/gvztt2UrUxJCyqELfCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T11:31:40.852519Z"},"content_sha256":"78205430d741f6e64c9a31419edf10be6ab627560548ca1d49634adc7fed8755","schema_version":"1.0","event_id":"sha256:78205430d741f6e64c9a31419edf10be6ab627560548ca1d49634adc7fed8755"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:S7OATB2RRCCYNL4UX5CKWD6FUW","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"RiskHarvester: A Risk-based Tool to Prioritize Secret Removal Efforts in Software Artifacts","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.SE"],"primary_cat":"cs.CR","authors_text":"Bradley Reaves, Laurie Williams, Setu Kumar Basak, Tanmay Pardeshi","submitted_at":"2025-02-03T03:32:12Z","abstract_excerpt":"Since 2020, GitGuardian has been detecting checked-in hard-coded secrets in GitHub repositories. During 2020-2023, GitGuardian has observed an upward annual trend and a four-fold increase in hard-coded secrets, with 12.8 million exposed in 2023. However, removing all the secrets from software artifacts is not feasible due to time constraints and technical challenges. Additionally, the security risks of the secrets are not equal, protecting assets ranging from obsolete databases to sensitive medical data. Thus, secret removal should be prioritized by security risk reduction, which existing secr"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2502.01020","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2502.01020/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:08:41Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"iFGC1xXXo7td7MrdAkvqqCfvtvl0YPPPN1pkhhpiSDPATXhUw6uuKs2R64UFLgF+lTTmdMMk54FDt8ki+aPJAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T11:31:40.852890Z"},"content_sha256":"c719adfa8b44f32f1ce735ffec9b9e5a22700cdff72ac6f871673135815f05cc","schema_version":"1.0","event_id":"sha256:c719adfa8b44f32f1ce735ffec9b9e5a22700cdff72ac6f871673135815f05cc"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/S7OATB2RRCCYNL4UX5CKWD6FUW/bundle.json","state_url":"https://pith.science/pith/S7OATB2RRCCYNL4UX5CKWD6FUW/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/S7OATB2RRCCYNL4UX5CKWD6FUW/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-07T11:31:40Z","links":{"resolver":"https://pith.science/pith/S7OATB2RRCCYNL4UX5CKWD6FUW","bundle":"https://pith.science/pith/S7OATB2RRCCYNL4UX5CKWD6FUW/bundle.json","state":"https://pith.science/pith/S7OATB2RRCCYNL4UX5CKWD6FUW/state.json","well_known_bundle":"https://pith.science/.well-known/pith/S7OATB2RRCCYNL4UX5CKWD6FUW/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:S7OATB2RRCCYNL4UX5CKWD6FUW","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"bc823462b534161172a2872314f8aa71404b42576e4f7979172735bcc54e113e","cross_cats_sorted":["cs.SE"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-02-03T03:32:12Z","title_canon_sha256":"33dd5434568c7736c7a31e3d6ad74113edb9f51a9a2dc6c172e9dc6cd1591bbb"},"schema_version":"1.0","source":{"id":"2502.01020","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2502.01020","created_at":"2026-07-05T10:08:41Z"},{"alias_kind":"arxiv_version","alias_value":"2502.01020v1","created_at":"2026-07-05T10:08:41Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2502.01020","created_at":"2026-07-05T10:08:41Z"},{"alias_kind":"pith_short_12","alias_value":"S7OATB2RRCCY","created_at":"2026-07-05T10:08:41Z"},{"alias_kind":"pith_short_16","alias_value":"S7OATB2RRCCYNL4U","created_at":"2026-07-05T10:08:41Z"},{"alias_kind":"pith_short_8","alias_value":"S7OATB2R","created_at":"2026-07-05T10:08:41Z"}],"graph_snapshots":[{"event_id":"sha256:c719adfa8b44f32f1ce735ffec9b9e5a22700cdff72ac6f871673135815f05cc","target":"graph","created_at":"2026-07-05T10:08:41Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2502.01020/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Since 2020, GitGuardian has been detecting checked-in hard-coded secrets in GitHub repositories. During 2020-2023, GitGuardian has observed an upward annual trend and a four-fold increase in hard-coded secrets, with 12.8 million exposed in 2023. However, removing all the secrets from software artifacts is not feasible due to time constraints and technical challenges. Additionally, the security risks of the secrets are not equal, protecting assets ranging from obsolete databases to sensitive medical data. Thus, secret removal should be prioritized by security risk reduction, which existing secr","authors_text":"Bradley Reaves, Laurie Williams, Setu Kumar Basak, Tanmay Pardeshi","cross_cats":["cs.SE"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-02-03T03:32:12Z","title":"RiskHarvester: A Risk-based Tool to Prioritize Secret Removal Efforts in Software Artifacts"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2502.01020","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:78205430d741f6e64c9a31419edf10be6ab627560548ca1d49634adc7fed8755","target":"record","created_at":"2026-07-05T10:08:41Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"bc823462b534161172a2872314f8aa71404b42576e4f7979172735bcc54e113e","cross_cats_sorted":["cs.SE"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-02-03T03:32:12Z","title_canon_sha256":"33dd5434568c7736c7a31e3d6ad74113edb9f51a9a2dc6c172e9dc6cd1591bbb"},"schema_version":"1.0","source":{"id":"2502.01020","kind":"arxiv","version":1}},"canonical_sha256":"97dc098751888586af94bf44ab0fc5a587e04c145ad7e58bfebef38ab8addc93","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"97dc098751888586af94bf44ab0fc5a587e04c145ad7e58bfebef38ab8addc93","first_computed_at":"2026-07-05T10:08:41.705639Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:08:41.705639Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"jF8/W8zqu6qh6hPzUDV5rZJKXl8lfMBHs7jX7Ox74k7QqcvhGUog6nTNBxxYaQXvSTjp5upGLiyyjYXtH+zDDA==","signature_status":"signed_v1","signed_at":"2026-07-05T10:08:41.706057Z","signed_message":"canonical_sha256_bytes"},"source_id":"2502.01020","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:78205430d741f6e64c9a31419edf10be6ab627560548ca1d49634adc7fed8755","sha256:c719adfa8b44f32f1ce735ffec9b9e5a22700cdff72ac6f871673135815f05cc"],"state_sha256":"e577cfd97fb67632eeda87f868083ff60311a3dc9347b845fe06493441b33110"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"V6kSFEPbLRzYpSKlTMj//N+so4cRGm6NYjI7vSRMj8ksVOTfTup6bIJwIYatMBM3yJ2x2619TNqmQEgBvjPMBg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-07T11:31:40.854788Z","bundle_sha256":"538970ef6953e984c2cfd23d619b0a17cacd1abf6b2fc8da99e055ad8ae90d4a"}}