Detect hardcoded secrets from surrounding strings alone: 98.74% F1 on one-third of the context, and 48 previously unknown live keys found

arXiv 2608.04523·medium signalXBlueskyLinkedInCopy link

StringGroup (shipped as Secretron) drops the usual whole-file context in favor of extracting the strings around a candidate secret, on the argument that strings carry higher contextual density plus obfuscation robustness and language independence. It hits 98.74% F1 on SecretBench using 33.2% of the original context while retaining over 80% of semantic information, beats LLM-based baselines under obfuscation and cross-language tests, and surfaced 48 previously unknown secret keys across 26 real applications. Cheap enough to run as a pre-commit hook on every agent-generated diff (ISSTA 2026).