Betterleaks Adds Publishable-Credential Filters to Reduce Secret-Scanning False Positives

Summary

Aikido authors added default Betterleaks signatures to filter credentials designed to be public. In a 100GB Common Crawl scan, they reported 2.37% fewer false positives and 27,886 fewer results to review, with about 5% more scanning time.

Key points

Generic-secret rules can flag public-by-design credentials because they resemble secrets but may lack a known format or liveness check.
Betterleaks now uses manually authored signatures to suppress common publishable credentials by default.
In a 100GB Common Crawl comparison, the authors reported 2.37% fewer false positives, or 27,886 fewer results to review.
The signatures increased scanning time by about 5%; the authors cautioned that Common Crawl's front-end content may inflate the measured reduction.
Credentials with ambiguous formats or permissions may require context or a liveness check; test credentials remain for manual triage because they can expose sensitive data.

Article Details

Event Type: Security tool update and false-positive reduction research
Impact: Betterleaks now filters publishable credentials from generic-secret findings by default. In a Common Crawl test, the signatures reduced false positives by 2.37% (27,886 fewer findings to review) while increasing scanning time by about 5%. The article cautions that public or test credentials can still expose sensitive data depending on their permissions and use.

Vendors

AlgoliaGoogle API keys and their ability to access Gemini. That’s one case. But I’ve seen this pattern with Algolia keys and others.Googlea particular permission, the key might be either sensitive or without risk. I’ve written a good bit about Google API keys and their ability to access Gemini. That’s one case. But I’ve seen this pattern with Algolia StripeEach pattern targets a specific credential type, like an AWS secret access key, a GitHub PAT, or a Stripe token. Once the scanner identifies a potential secret, it performs a liveness check by, for example,

Products

Geminisensitive or without risk. I’ve written a good bit about Google API keys and their ability to access Gemini. That’s one case. But I’ve seen this pattern with Algolia keys and others.

Tools

Betterleaksrules for the most common ones and reduced false positives by ~2%. These rules now ship by default in Betterleaks.