Chapter 23 — Application and software supply chain security: methods I
Lesson map
Lesson 23 published. Map, example, EX067.
flowchart TD
N0["Learning outcomes"]
N1["23.1 Why scan"]
N2["23.2 Patterns and variety"]
N3["Lab — Lab — scanning a diff"]
N4["23.3 Lab result"]
N5["23.4 Responding"]
N6["23.5 Preventing recurrence"]
N7["23.6 Measuring"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX067"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["23.1 Why scan"]
N2["23.2 Patterns and variety"]
N3["Lab — Lab — scanning a diff"]
N4["23.3 Lab result"]
N5["23.4 Responding"]
N6["23.5 Preventing recurrence"]
N7["23.6 Measuring"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX067"]
[Learning outcomes]
|
v
[23.1 Why scan]
|
v
[23.2 Patterns and variety]
|
v
[Lab — Lab — scanning a diff]
|
v
[23.3 Lab result]
|
v
[23.4 Responding]
|
v
[23.5 Preventing recurrence]
|
v
[23.6 Measuring]
|
v
[Worked example] --> [Exercise EX067]
Learning outcomes
You will (1) scan code changes for secrets; (2) combine patterns with character-variety checks; (3) respond to a found secret; (4) prevent recurrence.
23.1 Why scan
The token leak showed secrets can slip into repositories. Scanning checks every change before and after it is pushed.
Scanning before a push gives the developer a chance to fix the mistake privately; scanning after a push catches what the first check missed and alerts the society to revoke the secret. CampusEats uses both, as the token leak showed that a single layer was not enough. Lena also runs a one-time scan of the full repository history, which confirms that every secret it finds has already been revoked and gives the society a clean starting point for ongoing scanning.
23.2 Patterns and variety
Many tokens have known prefixes or lengths, so scanners use patterns. Random-looking strings also have high character variety (entropy). Combining both reduces false alarms on long but repetitive strings.
Lena tunes the patterns for the payment provider's key format, which has a fixed prefix, and sets an entropy threshold based on the lab results. She records both settings and the reason for each in the scanner's configuration, so that later changes can be compared with the original choices. Both settings are reviewed each term.
Lab — Lab — scanning a diff
"""Scan a synthetic diff for token-like strings using a pattern plus a character-variety check."""
import re, math
from collections import Counter
diff = ["+ API_URL = 'https://api.campuseats.example'", "+ TOKEN = 'cetk_9fQ2xLr7Vb3mZ8pK1sW4yT6n'",
"+ COLOR = 'aaaaaaaaaaaaaaaaaaaaaaaa'", "+ # see docs at example.org"]
def entropy(s):
c = Counter(s); return 0.0 + abs(sum(n / len(s) * math.log2(n / len(s)) for n in c.values()))
for line in diff:
for m in re.findall(r"'([A-Za-z0-9_]{20,})'", line):
print(f"{m[:8]}... entropy {entropy(m):.2f} -> {'LIKELY SECRET' if entropy(m) > 3.5 else 'low variety, ignore'}")
Run with python3 lab_secrets.py. Verified output:
cetk_9fQ... entropy 4.86 -> LIKELY SECRET
aaaaaaaa... entropy 0.00 -> low variety, ignore
23.3 Lab result
Two long strings match the pattern. The token-like string has entropy 4.86 bits per character and is flagged as a likely secret. The string of repeated "a" characters has entropy 0.00 and is ignored. The URL and comment lines do not match the pattern.
Lena keeps these four lines as test cases so that tuning cannot quietly break detection. The entropy figure shows why variety helps: a long string is not suspicious by itself, but a long string that looks random is. Lena explains this to new members with the lab output, which makes the scanner's decisions easier to trust.
23.4 Responding
When a secret is found: revoke or rotate it first, then remove it from the code, then check logs for any use. Rewriting history does not undo exposure, because copies may exist.
For CampusEats, rotation is done in the payment provider's dashboard and the secret store together, following the runbook. Lena times the procedure and finds it takes about ten minutes, which is why revoking first is practical rather than a theoretical ideal. Checking logs shows whether the secret was used while exposed.
23.5 Preventing recurrence
Pre-commit hooks, server-side scanning, secret stores, and onboarding training.
Each layer handles a different failure. The hook catches most mistakes on the developer's machine; server-side scanning catches what slips through or bypasses the hook; the secret store gives developers an easy place to put secrets so they are not tempted to hard-code them; and onboarding explains why all this matters, using the society's own token leak as the example. Lena reviews the layers each term to see which caught what.
23.6 Measuring
Lena tracks scanner precision and recall as in chapter 12.
She reuses the labelled commits from that study, adds new synthetic examples each term and compares results across scanner versions. Any real secret found after a push is counted as a miss for the pre-commit hook, which keeps the measure honest. The figures appear in the society's termly summary, next to the number of developers and commits, so changes in activity do not hide changes in performance. This lets trends be compared fairly.
Where to scan
Scanning covers the code repository, CI logs and configuration files. Lena also scans the society's shared documents folder once, finding an old file with a test database password; it is deleted and the password changed. Secrets turn up in places beyond code.
Worked example
A month later the server-side scanner flags a new commit containing a high-entropy string in a test file. The developer confirms it is a random test fixture, not a real key; it is added to the reviewed allowlist. No real secret has reached the public repository since the controls were added.
Synthetic case. Strings and events are synthetic.
Errors and limits
Entropy thresholds miss low-variety secrets such as simple passwords; patterns and reviews are also needed.
Exercises
- EX067 — Lab entropy. What entropies did the lab compute and with what result? Rubric: 3 = 4.86 likely secret; 0.00 ignore; 2 = partial; 1 = vague; 0 = none.
- EX068 — Response order. What is the first step when a secret is found? Rubric: 3 = revoke/rotate; 2 = partial; 1 = vague; 0 = none.
- EX069 — History rewrite. Why does rewriting history not undo exposure? Rubric: 3 = copies may exist; 2 = partial; 1 = vague; 0 = none.
Synthesis
Scan with patterns and variety, revoke first, and prevent recurrence.
Continue studying — chapter 23 of 40
← Chapter 22 (draft) · Course chapter index · Chapter 24 (draft) →