Better generic secrets detection starts with finding non-secrets

What it is

The second post in Aikido Security's noise-reduction series for their Betterleaks generic-secrets scanner. This installment ships a "publishable credentials denylist" — hand-written suppression rules for public-by-design credentials (Stripe publishable keys and other public-by-design SaaS/cloud key types) that generic entropy-based regexes otherwise flag.

How it works

Generic secret detection uses a broad "looks-like-a-secret" regex (high entropy, near keywords like api_key) rather than a known-format signature, so it has no liveness check to confirm a hit. The denylist adds signatures that match and remove known publishable key types before triage. The value the summary omits is the decision taxonomy for classifying a publishable credential — the framework an engineer would reuse to add rules:

flowchart TD
    A[Publishable credential] --> B{Unique shape?}
    B -->|Yes| C[Write regex, suppress directly]
    B -->|No, generic string| D{Nearby keyword ties it to a provider?}
    D -->|Yes| E[Match on context keyword]
    D -->|Same format as a secret key| F[Add secret-rule signature + HTTP liveness check; discard if not live]
    F --> G[Sensitive only if misconfigured: also needs liveness check]

Where a publishable key shares the exact format of a secret key from the same provider, you cannot suppress on shape — you must write a detection signature for the secret type with an HTTP liveness check, let it catch both, and discard the one that isn't live.

What to do

• If you run Betterleaks, these rules ship by default now — no action needed to gain the ~2% false-positive reduction.
• To extend coverage, the authors explicitly invite PRs adding new publishable-key signatures, and provide the taxonomy above to guide which technique fits a given key type.
• Note the ordering rationale: cheap deterministic filters first (token efficiency, this denylist, public-secrets denylist, splitting token vs. username/password rules), with ML-assisted triage reserved for last, for residual ambiguity.

Caveats

• The 2.37% reduction (27,886 fewer findings) is against 100GB of Common Crawl, which the authors say skews toward front-end HTML/JS where publishable keys concentrate — so it likely overstates the benefit on other corpora. Cost was ~5% more scan time.
• "Public" does not mean "safe": some publishable keys are sensitive only if misconfigured, so suppression rules can't be applied blindly per provider.
• The authors report AI was "surprisingly useless" for authoring these signatures; they wrote them manually.
• The fetched text cuts off mid-sentence on the fifth edge case, so the full misconfiguration criterion isn't captured here.