Broke but Breached: Secret Scanning at Scale on a Student Budget

The speaker, a recent graduate, opened with how leaked credentials have fed real breaches and why they are preventable with pipeline checks. The research targeted Visual Studio Code extensions from the marketplace, many of which ship with embedded environment variables, and the number of new extensions grew sharply through AI-assisted coding. Early runs used friends' Azure accounts, but CPU-heavy scanning crashed some VMs, so the pipeline moved to a managed DigitalOcean Kubernetes cluster that used free student credits.

The pipeline had three stages: gathering extension links from the marketplace sitemap, scanning packages with TruffleHog, and normalizing results. Scanner pods ran on every node, with a Go orchestrator, PostgreSQL storage and an SQS queue, reaching roughly 100 extensions per minute. Verified findings included cloud and AI service keys, GitHub and npm tokens, and Hugging Face tokens; one npm token remained valid years after its extension was last updated. Blocked IP addresses were handled by rotating them through a queue with a cooldown timer, and the whole effort cost under $15.

Trends shifted from blockchain API keys around 2022 to AI service keys by 2025. The takeaway is that attackers could run similar work at far larger scale, so developers should scan before commits and in pipelines, rotate exposed secrets, and enable logging with alerts for unusual credential use. Future plans include the JetBrains and Open VSX marketplaces.