IssueGuard: Real-Time Secret Leak Prevention Tool for GitHub Issue Reports

TL;DR

IssueGuard tackles the problem of accidental secret exposure in issue reports by delivering real-time, pre-submission detection within the user interface. The approach combines regex-based candidate extraction with a fine-tuned CodeBERT classifier to achieve high accuracy (F1 = 92.70%) while keeping latency low (≈198 ms end-to-end) through a client–server Chrome extension design and GPU-accelerated inference. The paper demonstrates strong model performance, favorable comparisons to post-submission tools, and a positive user study demonstrating usability and confidence gains. This work offers a practical, privacy-conscious solution that can be extended to additional platforms and browsers to prevent secret leakage across collaborative workflows.

Abstract

GitHub and GitLab are widely used collaborative platforms whose issue-tracking systems contain large volumes of unstructured text, including logs, code snippets, and configuration examples. This creates a significant risk of accidental secret exposure, such as API keys and credentials, yet these platforms provide no mechanism to warn users before submission. We present \textsc{IssueGuard}, a tool for real-time detection and prevention of secret leaks in issue reports. Implemented as a Chrome extension, \textsc{IssueGuard} analyzes text as users type and combines regex-based candidate extraction with a fine-tuned CodeBERT model for contextual classification. This approach effectively separates real secrets from false positives and achieves an F1-score of 92.70\% on a benchmark dataset, outperforming traditional regex-based scanners. \textsc{IssueGuard} integrates directly into the web interface and continuously analyzes the issue editor, presenting clear visual warnings to help users avoid submitting sensitive data. The source code is publicly available at \href{https://github.com/nafiurahman00/IssueGuard}{https://github.com/nafiurahman00/IssueGuard}, and a demonstration video is available at \href{https://youtu.be/kvbWA8rr9cU}{https://youtu.be/kvbWA8rr9cU}.

Figures (3)

• Figure 1: Workflow of IssueGuard
• Figure 2: Demonstration IssueGuard. As the user types, the extension sends text to the backend. Real secrets are highlighted in red, while regex-based positives such as placeholders are ignored.
• Figure 3: Participants' satisfaction with various aspects of the IssueGuard tool.