Identifying API, Tokens, Credentials and Secrets Keys from Github Private and Public Repositories

DevSecOps policy-as-code: Detecting and remediating over-privileged access tokens in SDLC tools

Evaluating Runtime Security in DevSecOps Pipelines with SELinux Mandatory Access Control

Runtime security in DevSecOps pipelines remains a significant challenge because widely used tools such as Bandit, Hadolint, and Trivy detect vulnerabilities during development but do not enforce security at execution time. This paper evaluates a three-layer defense-in-depth model combining DevSecOps tools, Linux Discretionary Access Control (DAC), and SELinux Mandatory Access Control (MAC). Experiments were conducted on Flask and Django applications running on Red Hat Enterprise Linux 9.6 with SELinux in enforcing mode. Results show that DevSecOps tools reported warnings but provided no runtime protection, DAC failed under permissive configurations such as chmod 777, and SELinux MAC consistently blocked unauthorized file-write attempts, generating 10,324 AVC denials for Flask and 2,065 for Django. SELinux introduced approximately 50% throughput overhead in Flask, representing a measurable but acceptable trade-off for strong runtime enforcement.

Tools for detecting secret leaks in source code repositories

This article examines tools for detecting secret leaks in source code repositories as an element of software system security engineering. The article examines the causes of credentials, tokens, private keys, and service parameters being included in version history, as well as methods for their detection based on signature search, entropy assessment, contextual filtering, and liveness checking of the detected values. The need for incorporating such tools into a secure development framework is substantiated: local checks, change submission control, repository history analysis, and automated response. It has been shown that the greatest effect is achieved by combining technical scanning, secret management policies, and regular rotation of compromised data.

Trusted Credentials, Untrusted Behavior: Benchmarking LLM-Agent Security in High-Performance Computing

The threat model in the HPC setting is defined, attack surfaces created by schedulers, shared storage, multi-project accounts, and scientific workflows are identified, and where current controls fall short is examined.

Commit-Message-Augmented Static Analysis of Cross-Site Scripting Fixes in Java Web Applications

Cross-Site Scripting (XSS) remains a common and high-impact web vulnerability. Detecting XSS with high precision is difficult because exploitability depends on end-to-end data flow (sources, sanitizers, and sinks), framework-specific rendering semantics, and the correctness of context-aware output encoding. Although secure development lifecycles increasingly integrate static application security testing (SAST) into CI/CD pipelines, practical adoption is often limited by false positives and incomplete modeling of project-specific sanitization and templating behavior. In parallel, machine learning (ML) approaches show promise for learning vulnerability-relevant patterns from code, but they depend on the availability of realistic labeled data. This paper studies a low-cost repository-native signal that is routinely available but underused in ML-assisted static analysis: commit messages. We propose a mining and weak-labeling pipeline for Java repositories that identifies candidate XSS-fix commits using message heuristics grounded in OWASP guidance and CWE taxonomy, aligns commit messages with pre-/post-change code contexts extracted from diffs, and trains classifiers under two feature settings: (i) code-only and (ii) code+commit-message fusion. Across three model families (Random Forest, TextCNN, and BiLSTM), commit-message fusion consistently improves F1 and AUPRC and reduces false positives, suggesting that developer intent provides a useful auxiliary signal for security triage.

WebMCP-Phalanx: Enforcing and Characterizing Trust Boundaries for Browser-Integrated LLM Agents

The emerging W3C WebMCP proposal enables LLM agents to invoke tools exposed by web pages. In multi-party web environments, however, integrating agent execution into a browser security model centered on the Same-Origin Policy (SOP) leaves insufficient provenance and lifecycle guarantees for agent-accessible tools, creating three risks: subject-attribution spoofing, uncontrolled tool lifecycles, and semantic prompt injection. We propose WebMCP-Phalanx, a dual-layer agent runtime architecture. Its first layer provides a browser-native trust anchor that binds each tool to its registering principal through cryptographically protected capability credentials and propagates provenance labels throughout the tool lifecycle. Its second layer separates semantic inspection from privileged tool use. A Quarantine Agent (Q-LLM), without tool invocation authority, inspects tool metadata, outputs, and page-supplied content for prompt injection. Validated content is then forwarded to a Privileged Agent (P-LLM) for execution, while the Q-LLM's internal state remains hidden from page scripts. Empirical evaluation shows that the browser-native ownership mechanism reduces revocation and overwrite attack success from 100\% to 0\%. The dual-agent runtime blocks all 80 prompt-injection attempts embedded in tool descriptions and limits tool-return attacks to 2 successful cases out of 80. Across experiments, task utility remains statistically indistinguishable from the no-attack baseline. Under a white-box adaptive attacker, however, description-based filtering can be bypassed through malicious tool names invoked before inspection. This finding motivates a call-timing gate that delays tool invocation until all agent-visible tool metadata has been validated.