v0.1: first release, 12 labels, dataset v2.4.1

README.md

@@ -1,3 +1,142 @@
 ---
 license: apache-2.0
+base_model: jhu-clsp/ettin-encoder-17m
+pipeline_tag: token-classification
+language:
+  - en
+tags:
+  - secrets
+  - secret-detection
+  - credentials
+  - security
+  - ner
 ---
+
+# cbx-secrets-detector-17M
+
+Finds **secrets and credentials** (passwords, API keys, tokens, private keys, cloud and database credentials) in
+code, config files, logs, tickets and chat, and returns the exact position of each value with one of **12 labels**.
+17M parameters; about 6 ms per 1,000 tokens on a GPU and 37 ms on a CPU.
+
+This is the fastest size, and the one to use on a CPU. Fine-tuned from [jhu-clsp/ettin-encoder-17m](https://huggingface.co/jhu-clsp/ettin-encoder-17m).
+Version **v0.1**, the first release (use `--revision v0.1` to pin it). Also available in [32M](https://huggingface.co/CobuildX-AI/cbx-secrets-detector-32M).
+
+Unlike rule-based scanners, it reads the context: it finds passwords and keys that have no fixed prefix, and it leaves
+alone placeholders, variable references, hashes and obviously fake values.
+
+## Labels
+
+| Label | Covers |
+|---|---|
+| PASSWORD | Passwords and passphrases: logins, service accounts, keystores, key derivation |
+| DATABASE_CREDENTIAL | A database connection URI that holds a password (the whole URI), or a database password |
+| API_KEY | Keys for calling an API or service (`sk_live_…`, hex service keys) |
+| ACCESS_TOKEN | Bearer and access tokens that are not JWTs: OAuth tokens, personal access tokens (`ghp_…`) |
+| JWT_TOKEN | Well-formed JWTs (`eyJ….….…`) |
+| SESSION_SECRET | Secrets that sign or encrypt sessions or cookies |
+| WEBHOOK_SECRET | Secrets that sign or verify webhook deliveries (`whsec_…`) |
+| CLOUD_CREDENTIAL | Cloud provider secrets: AWS secret access keys, cloud client secrets |
+| PRIVATE_KEY | Private keys (PEM, OpenSSH, service-account `private_key`), the whole block |
+| CERTIFICATE_SECRET | Certificate bundles that contain a private key (PKCS#12 / PFX) |
+| ENCRYPTION_KEY | Symmetric encryption keys (AES keys, data keys, master keys) |
+| GENERIC_SECRET | A secret whose type the text does not say |
+
+**Not secrets** (not labelled): references such as `${API_KEY}` or `os.environ["X"]`; placeholders such as
+`<your-api-key>` or `CHANGEME`; masked values; identifiers (AWS access key IDs `AKIA…`, UUIDs, account and request
+ids, usernames); public keys and certificates; hashes and digests, including git commit SHAs; documented example values
+such as `AKIAIOSFODNN7EXAMPLE`. A realistic value is labelled even when its name says "test" or "example": the model
+cannot know whether it is live.
+
+## How to use
+
+**1. Download and install**
+
+```bash
+pip install -U huggingface_hub
+hf download CobuildX-AI/cbx-secrets-detector-17M --revision v0.1 --local-dir cbx-secrets-detector-17M
+cd cbx-secrets-detector-17M
+pip install -r requirements.txt
+```
+
+**2. Use it in your code**
+
+`SecretDetector` (in `cbx_secrets.py`, part of this repo) loads the model once:
+
+```python
+from cbx_secrets import SecretDetector
+
+det = SecretDetector()                 # uses a GPU if one is available
+text = 'STRIPE_SECRET_KEY=sk_live_4eC39HqLyjWDarjtT1zdp7dcQw8vXk2Z'
+det.extract(text)
+# [{'label': 'API_KEY', 'text': 'sk_live_4eC39HqLyjWDarjtT1zdp7dcQw8vXk2Z', 'start': 18, 'end': 58}]
+
+det.redact(text)
+# 'STRIPE_SECRET_KEY=[API_KEY]'
+
+det.extract(text, labels=["PASSWORD", "PRIVATE_KEY"])   # keep only some labels
+```
+
+- Context length is 7,999 tokens, read in a single pass. Longer texts are split into overlapping pieces automatically.
+- `redact()` replaces each value found with its label, or with your own `template`.
+- The values in these examples are invented.
+
+**3. Optional: check your setup**
+
+`python example.py` runs four sample texts (all values invented) and prints what it finds.
+
+## Results
+
+Span F1, label-agnostic: a found value counts if it overlaps a true secret, whatever its label (the benchmarks and
+the scanners use different type names). Precision and recall in brackets. "False alarms" is the share of labelled
+non-secret lines or candidates on which something is flagged.
+
+| Model | CredData test | false alarms | Issue reports test | false alarms | CBX secrets test |
+|---|---|---:|---|---:|---|
+| **cbx-secrets-detector-17M** | 0.805 (0.80 / 0.81) | 0.9% | 0.836 (0.90 / 0.78) | 0.9% | 0.983 (0.99 / 0.98) |
+| cbx-secrets-detector-32M | 0.820 (0.77 / 0.87) | 1.3% | 0.861 (0.86 / 0.86) | 1.4% | 0.998 (1.00 / 1.00) |
+| Gitleaks 8.30.1 | 0.442 (0.90 / 0.29) | 0.6% | 0.678 (0.93 / 0.54) | 0.5% | 0.757 (0.99 / 0.61) |
+| detect-secrets 1.5.0 | 0.460 (0.47 / 0.45) | 9.8% | 0.290 (0.40 / 0.23) | 4.0% | 0.626 (0.90 / 0.48) |
+| TruffleHog 3.99.2 | 0.042 (0.38 / 0.02) | 0.8% | 0.228 (0.66 / 0.14) | 0.9% | 0.215 (1.00 / 0.12) |
+
+- **CredData test:** [Samsung CredData](https://github.com/Samsung/CredData) (secrets obfuscated by Samsung): the test
+  half of the repositories, 168 repositories with 3,493 secrets and 17,961 labelled non-secret lines. No test
+  repository was used for training or for choosing the model.
+- **Issue reports test:** the test split of the issue-report dataset of Ahmed et al. (see Training data): 949 secrets
+  and 8,132 non-secret candidates, scored per candidate. Texts that also appear in its training split were removed.
+- **CBX secrets test:** our own held-out test data, generated by CobuildX and checked against our annotation guide:
+  3,000 texts with 3,136 secrets across all 12 labels. With the label
+  required to match exactly as well, this model scores **0.961** (per label: CERTIFICATE_SECRET 1.00, ENCRYPTION_KEY 1.00, JWT_TOKEN 1.00, PRIVATE_KEY 1.00, API_KEY 1.00, WEBHOOK_SECRET 0.99, CLOUD_CREDENTIAL 0.99, ACCESS_TOKEN 0.99, SESSION_SECRET 0.97, GENERIC_SECRET 0.94, DATABASE_CREDENTIAL 0.90, PASSWORD 0.89). It comes from the same
+  generators as part of the training data, so it overstates accuracy on real text; the two benchmarks above are the
+  better guide.
+- **Scanners** were run offline with their default rules and no live verification; TruffleHog normally relies on
+  verification, so its numbers here understate it.
+
+**Speed.** Median 6 ms (p95 6 ms) per text of 1,000 tokens on an NVIDIA TITAN RTX (fp16), 37 ms (p95 38 ms) on an Intel i7-10700 CPU with 8 threads; texts processed one at a time, end to end (text in, spans out).
+
+## Limitations
+
+- English only. Trained for code, config files, logs, tickets and chat.
+- **Long encoded data:** on long runs of random-looking characters (an inline base64 source map, a minified bundle,
+  a log full of hex session ids) the model can flag many short pieces as secrets. Skip minified and generated files
+  where you can.
+- Recall is lower for tokens with no known prefix and no telling name nearby (`key`, `token`, `password`).
+- Labels are less certain than detection: a password in a database context can be labelled PASSWORD or
+  DATABASE_CREDENTIAL (exact F1 on our test set 0.89 for the weaker of the two), and a database URI is sometimes returned as two spans split at the password.
+- It does not check whether a secret is live, and it can miss secrets: use it as a detection aid alongside rotation and
+  review, not as a guarantee.
+
+## Training data
+
+- **CBX secrets train data:** generated by CobuildX and checked against our annotation guide: code, configs, logs,
+  chat and documents with invented secrets and hard negatives (placeholders, references, hashes, fake values).
+- **Samsung CredData** (lines and labels from 116 repositories with MIT, Apache-2.0 or BSD licences; values already
+  obfuscated by Samsung). The repositories and their licences are listed in `training_data_sources.csv`.
+- **Issue reports:** the training split of *Secret Leak Detection in Software Issue Reports using LLMs*, Ahmed et
+  al., arXiv:2410.23657, dataset [10.5281/zenodo.19622962](https://doi.org/10.5281/zenodo.19622962), licensed
+  [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/). Changed: every real secret was replaced by an invented value
+  of the same shape before training, and texts were cut into windows. No real secret from this dataset is in the model's
+  training data or in this repository.
+
+## Licence
+
+Apache-2.0. Base model: Ettin (MIT, arXiv:2507.11412).

cbx_secrets.py

@@ -0,0 +1,132 @@
+"""SecretDetector: find secrets and credentials in code, configs, logs, chats and documents with a compact Ettin
+token tagger.
+
+    from cbx_secrets import SecretDetector
+    det = SecretDetector()                 # this folder: model.safetensors, config.json, tokenizer, secrets_config.json
+    det.extract('export STRIPE_KEY="sk_live_..."')
+    det.redact('export STRIPE_KEY="sk_live_..."')
+
+(Not named secrets.py: that would hide Python's standard `secrets` module.)
+
+The model tags every token with a BIO tag (B-/I- per label, O = not a secret); tags are joined into character spans.
+A text is read in one pass, up to the model's full context length (7,999 tokens, from config.json). Only a text
+longer than that is read in overlapping pieces; a token in an overlap takes its tag from the piece where it sits
+further from the edge, so a value split by a piece boundary is still read in one piece.
+"""
+import json, os, time
+
+import torch
+import torch.nn as nn
+from safetensors.torch import load_file
+from transformers import AutoConfig, AutoModel, AutoTokenizer
+
+_EDGE_LEAD, _EDGE_TRAIL = "=.\"'*<:;,`", ".,;:\"'*>`"   # punctuation a token can glue onto a value
+
+
+class _Tagger(nn.Module):
+    def __init__(self, config, n_tags):
+        super().__init__()
+        self.backbone = AutoModel.from_config(config, attn_implementation="sdpa")
+        self.head = nn.Linear(config.hidden_size, n_tags)
+
+    def forward(self, input_ids):
+        h = self.backbone(input_ids=input_ids, attention_mask=torch.ones_like(input_ids)).last_hidden_state
+        return self.head(h.float())
+
+
+class SecretDetector:
+    def __init__(self, path=None, device=None, overlap=64, join="none"):
+        path = path or os.path.dirname(os.path.abspath(__file__))
+        self.cfg = json.load(open(os.path.join(path, "secrets_config.json")))
+        self.tags, self.labels = self.cfg["tags"], self.cfg["labels"]
+        self.overlap, self.join = overlap, join                  # join="word" also merges pieces of one word
+        self.min_len = self.cfg.get("min_len") or {}            # {"*": n, "<LABEL>": n}: shorter spans are dropped
+        self.device = device or ("cuda" if torch.cuda.is_available() else "cpu")
+        self.tok = AutoTokenizer.from_pretrained(path)
+        config = AutoConfig.from_pretrained(path)
+        self.max_length = config.max_position_embeddings          # the model's full context, incl. [CLS]/[SEP]
+        self.model = _Tagger(config, len(self.tags))
+        self.model.load_state_dict(load_file(os.path.join(path, "model.safetensors")))
+        self.model.to(self.device).eval()
+
+    # ---------------------------------------------------------------- core
+    @torch.inference_mode()
+    def _tag(self, ids):
+        """One tag id per token: the whole text in one pass, or overlapping pieces if it exceeds the context."""
+        step = self.max_length - 2                               # room for [CLS] and [SEP]
+        if len(ids) <= step: starts = [0]
+        else:
+            stride = step - self.overlap
+            starts = list(range(0, len(ids) - step, stride)) + [len(ids) - step]
+        out = [0] * len(ids)
+        for k, s in enumerate(starts):
+            e = min(s + step, len(ids))
+            x = torch.tensor([[self.tok.cls_token_id] + ids[s:e] + [self.tok.sep_token_id]], device=self.device)
+            with torch.autocast(device_type="cuda", dtype=torch.float16, enabled=self.device == "cuda"):
+                pred = self.model(x).argmax(-1)[0, 1:-1].tolist()
+            lo = s if k == 0 else s + self.overlap // 2             # keep the middle of each piece
+            hi = e if k == len(starts) - 1 else e - self.overlap // 2
+            for i in range(lo, hi): out[i] = pred[i - s]
+        return out
+
+    def _spans(self, text, offsets, tag_ids):
+        spans, cur = [], None
+        for (a, b), t in zip(offsets, tag_ids):
+            while a < b and text[a].isspace(): a += 1
+            while b > a and text[b - 1].isspace(): b -= 1
+            if a >= b: continue
+            tag = self.tags[t]
+            if tag == "O":
+                if cur: spans.append(cur); cur = None
+                continue
+            prefix, label = tag.split("-", 1)
+            if prefix == "B" or cur is None or cur[2] != label:
+                if cur: spans.append(cur)
+                cur = [a, b, label]
+            else:
+                cur[1] = b
+        if cur: spans.append(cur)
+        out = []
+        for a, b, label in spans:
+            while a < b and text[a] in _EDGE_LEAD: a += 1
+            while b > a and text[b - 1] in _EDGE_TRAIL: b -= 1
+            if b > a: out.append(dict(label=label, text=text[a:b], start=a, end=b))
+        out = self._join(text, out) if self.join == "word" else out
+        return [s for s in out if s["end"] - s["start"] >= self.min_len.get(s["label"], self.min_len.get("*", 1))]
+
+    @staticmethod
+    def _join(text, spans):
+        """Optional: spans separated only by non-whitespace become one span, labelled by the label covering most of its
+        characters. Off by default: it merges adjacent secrets such as `user:password`."""
+        out = []
+        for s in spans:
+            gap = text[out[-1]["end"]:s["start"]] if out else " "
+            if out and len(gap) <= 20 and not any(c.isspace() for c in gap):
+                p = out[-1]
+                p["chars"][s["label"]] = p["chars"].get(s["label"], 0) + s["end"] - s["start"]
+                p.update(end=s["end"], text=text[p["start"]:s["end"]], label=max(p["chars"], key=p["chars"].get))
+            else:
+                out.append(dict(s, chars={s["label"]: s["end"] - s["start"]}))
+        for s in out: del s["chars"]
+        return out
+
+    # ---------------------------------------------------------------- public API
+    def extract(self, text, labels=None):
+        """List of {label, text, start, end}; `labels` keeps only those types."""
+        enc = self.tok(text, add_special_tokens=False, return_offsets_mapping=True, verbose=False)
+        spans = self._spans(text, enc["offset_mapping"], self._tag(enc["input_ids"]))
+        return [s for s in spans if labels is None or s["label"] in labels]
+
+    def extract_batch(self, texts, labels=None):
+        return [self.extract(t, labels) for t in texts]
+
+    def redact(self, text, labels=None, template="[{label}]"):
+        """The text with every found secret replaced by `template` (default "[API_KEY]", "[PASSWORD]", ...)."""
+        out, last = [], 0
+        for s in self.extract(text, labels):
+            out += [text[last:s["start"]], template.format(label=s["label"])]; last = s["end"]
+        return "".join(out + [text[last:]])
+
+    def timed_extract(self, text):
+        t = time.perf_counter(); spans = self.extract(text)
+        return spans, (time.perf_counter() - t) * 1000

config.json

@@ -0,0 +1,64 @@
+{
+  "architectures": [
+    "ModernBertForMaskedLM"
+  ],
+  "attention_bias": false,
+  "attention_dropout": 0.0,
+  "bos_token_id": 50281,
+  "causal_mask": false,
+  "classifier_activation": "gelu",
+  "classifier_bias": false,
+  "classifier_dropout": 0.0,
+  "classifier_pooling": "mean",
+  "cls_token_id": 50281,
+  "decoder_bias": true,
+  "deterministic_flash_attn": false,
+  "dtype": "float32",
+  "embedding_dropout": 0.0,
+  "eos_token_id": 50282,
+  "global_attn_every_n_layers": 3,
+  "gradient_checkpointing": false,
+  "hidden_activation": "gelu",
+  "hidden_size": 256,
+  "initializer_cutoff_factor": 2.0,
+  "initializer_range": 0.02,
+  "intermediate_size": 384,
+  "is_causal": false,
+  "layer_norm_eps": 1e-05,
+  "layer_types": [
+    "full_attention",
+    "sliding_attention",
+    "sliding_attention",
+    "full_attention",
+    "sliding_attention",
+    "sliding_attention",
+    "full_attention"
+  ],
+  "local_attention": 128,
+  "max_position_embeddings": 7999,
+  "mlp_bias": false,
+  "mlp_dropout": 0.0,
+  "model_type": "modernbert",
+  "norm_bias": false,
+  "norm_eps": 1e-05,
+  "num_attention_heads": 4,
+  "num_hidden_layers": 7,
+  "pad_token_id": 50283,
+  "position_embedding_type": "sans_pos",
+  "rope_parameters": {
+    "full_attention": {
+      "rope_theta": 160000.0,
+      "rope_type": "default"
+    },
+    "sliding_attention": {
+      "rope_theta": 160000.0,
+      "rope_type": "default"
+    }
+  },
+  "sep_token_id": 50282,
+  "sparse_pred_ignore_index": -100,
+  "sparse_prediction": false,
+  "tie_word_embeddings": true,
+  "transformers_version": "5.21.0",
+  "vocab_size": 50368
+}

example.py

@@ -0,0 +1,31 @@
+"""Check the install: find and redact secrets in four sample texts.
+
+    python example.py
+
+Every value below is invented: random characters in the shapes real services use. None is a working credential.
+"""
+from cbx_secrets import SecretDetector
+
+SAMPLES = [
+    "DATABASE_URL=postgres://app_user:Vq7mR2xL9pTz@db.internal.example:5432/orders\n"
+    "STRIPE_SECRET_KEY=sk_live_4eC39HqLyjWDarjtT1zdp7dcQw8vXk2Z\n"
+    "LOG_LEVEL=info\n",
+    'import boto3\n\n'
+    's3 = boto3.client("s3", aws_access_key_id="AKIAQ3W7RNA2FDX5KZPM",\n'
+    '                  aws_secret_access_key="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")\n',
+    'Hey, the deploy is failing again. I used `curl -H "Authorization: Bearer ghp_8xK2mQ9vL4nR7tY1wZ3pB6cF0hJ5sD2gA9eU"`\n'
+    "and got a 401. The commit is 3f9a1c2e7b4d8f6a0e5c9b2d1a7f4e8c6b3d0a9f if that helps.",
+    'jwt_secret: "Zr8!kP2qW9xM4vT7nL1sB6yH3cF0gJ5d"\n'
+    "session_cookie_name: app_session\n"
+    'api_key: "${API_KEY}"   # read from the environment\n',
+]
+
+det = SecretDetector()
+print(f"model loaded on {det.device}\n")
+for text in SAMPLES:
+    spans, ms = det.timed_extract(text)
+    print(text)
+    for s in spans:
+        print(f"   {s['label']:20} {s['text']!r}  [{s['start']}:{s['end']}]")
+    print(f"   redacted: {det.redact(text)!r}")
+    print(f"   ({ms:.0f} ms)\n")

model.safetensors

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:c537bad4df7f4ba4d70799cbf22a2344e6321279aa2355cd2e6fe37a5ed37dd5
+size 67220156

requirements.txt

@@ -0,0 +1,3 @@
+torch>=2.1
+transformers>=5.0
+safetensors>=0.4

secrets_config.json

@@ -0,0 +1,53 @@
+{
+ "version": "v0.1",
+ "base_model": "jhu-clsp/ettin-encoder-17m",
+ "labels": [
+  "API_KEY",
+  "ACCESS_TOKEN",
+  "JWT_TOKEN",
+  "SESSION_SECRET",
+  "WEBHOOK_SECRET",
+  "PASSWORD",
+  "DATABASE_CREDENTIAL",
+  "CLOUD_CREDENTIAL",
+  "PRIVATE_KEY",
+  "CERTIFICATE_SECRET",
+  "ENCRYPTION_KEY",
+  "GENERIC_SECRET"
+ ],
+ "tags": [
+  "O",
+  "B-API_KEY",
+  "I-API_KEY",
+  "B-ACCESS_TOKEN",
+  "I-ACCESS_TOKEN",
+  "B-JWT_TOKEN",
+  "I-JWT_TOKEN",
+  "B-SESSION_SECRET",
+  "I-SESSION_SECRET",
+  "B-WEBHOOK_SECRET",
+  "I-WEBHOOK_SECRET",
+  "B-PASSWORD",
+  "I-PASSWORD",
+  "B-DATABASE_CREDENTIAL",
+  "I-DATABASE_CREDENTIAL",
+  "B-CLOUD_CREDENTIAL",
+  "I-CLOUD_CREDENTIAL",
+  "B-PRIVATE_KEY",
+  "I-PRIVATE_KEY",
+  "B-CERTIFICATE_SECRET",
+  "I-CERTIFICATE_SECRET",
+  "B-ENCRYPTION_KEY",
+  "I-ENCRYPTION_KEY",
+  "B-GENERIC_SECRET",
+  "I-GENERIC_SECRET"
+ ],
+ "scheme": "BIO",
+ "max_length": 7999,
+ "parameters": 16803865,
+ "min_len": {
+  "*": 10,
+  "PASSWORD": 4,
+  "DATABASE_CREDENTIAL": 4
+ }
+}

tokenizer_config.json

@@ -0,0 +1,17 @@
+{
+  "backend": "tokenizers",
+  "clean_up_tokenization_spaces": true,
+  "cls_token": "[CLS]",
+  "is_local": true,
+  "local_files_only": false,
+  "mask_token": "[MASK]",
+  "model_input_names": [
+    "input_ids",
+    "attention_mask"
+  ],
+  "model_max_length": 8192,
+  "pad_token": "[PAD]",
+  "sep_token": "[SEP]",
+  "tokenizer_class": "TokenizersBackend",
+  "unk_token": "[UNK]"
+}

training_data_sources.csv

@@ -0,0 +1,117 @@
+repository,commit,licence,training_rows
+https://github.com/9seconds/mtg,889ab6c227818e92383a286b0dafc95ccb603a85,MIT,20
+https://github.com/AdysTech/CredentialManager,d30cf565f0ec8d20729c72a80ee9ab7fcb4677a2,MIT,9
+https://github.com/alibaba/Sentinel,f972b103db7ac650adef235de704dc44dd782bcb,Apache-2.0,40
+https://github.com/an-tao/drogon,a70a2844b1aba63643801c26c35cc0a68b03a8c1,MIT,28
+https://github.com/angular/protractor,4bc80d1a459542d883ea9200e4e1f48d265d0fda,MIT,59
+https://github.com/askmike/gekko,ff5698f1ae6329bab5729f145c35a74161e82bac,MIT,20
+https://github.com/aspnet/Security,26d27d871b7992022c082dc207e3d126e1d9d278,Apache-2.0,49
+https://github.com/auth0/node-jsonwebtoken,74d5719bd03993fcf71e3b176621f133eb6138c0,MIT,22
+https://github.com/aws/aws-sdk-java,a6734b23bfaf833435bed2fe648bd0c85a259260,Apache-2.0,787
+https://github.com/aws/chalice,bd6e2a29f1bc23e56c8cd35612e2567764e5085e,Apache-2.0,102
+https://github.com/backup/backup,b9e01da6d29264b147c19f98204f75859a680a6f,MIT,59
+https://github.com/balderdashy/sails,d4928254d9bf77fe0d6104cf57f1c56852ce1962,MIT,30
+https://github.com/binarylogic/authlogic,5e0253dcd91ea72c9a5acc5f62590142b7f4bdb4,MIT,54
+https://github.com/boardgameio/boardgame.io,5ac35302ee80626d0bf50a451472bbfc127cf696,MIT,62
+https://github.com/bookshelf/bookshelf,7704fbc5e83a35357d89458d9269a7e739964296,MIT,25
+https://github.com/brocaar/chirpstack-network-server,6e51d2acb3f1f4a24a3bc4d6327f04cc993396ae,MIT,40
+https://github.com/cloudfoundry/credhub,262e02dd2f29dc37d7e01b1445d95ef953fc332d,Apache-2.0,169
+https://github.com/cloudskiff/driftctl,7604577ba78d12fc2f39a38f3792d3bfd2ba22f3,Apache-2.0,59
+https://github.com/cloudtools/troposphere,f5e01ae46eb0c2ddf738f29b0d9b6ca6b284ab29,BSD,64
+https://github.com/coleifer/peewee,66784c9f2619693e5439ad0b22cd544c10e97440,MIT,67
+https://github.com/composer/composer,9a32bf9709960017f944753c68ab05c8de94add0,MIT,59
+https://github.com/containrrr/watchtower,b196629d0491fa5c5b81b5e95dcdefbb2d82e711,Apache-2.0,15
+https://github.com/danger/danger,af3d856d5cbaaebf534b853df347373dbd0ee30b,MIT,81
+https://github.com/dbcli/pgcli,e0a4c18c4a074016beef46886b03e456102e2db1,BSD,25
+https://github.com/DefactoSoftware/Hours,d6951405186bbb91ad392b7646a9fd56b8ed1867,MIT,41
+https://github.com/django-extensions/django-extensions,af38fc5e6f3a3ad28b81d11f6d1104f1ef5daafe,MIT,50
+https://github.com/docker/build-push-action,779802e2ee6be8ce955113a167e04897dd1beed4,Apache-2.0,26
+https://github.com/docker/docker-py,96c12726fdb9b24e985b4de74d5c82145ccd8185,Apache-2.0,57
+https://github.com/doraemonext/wechat-python-sdk,bf6f6f3d4a5440feb73a51937059d7feddc335a0,BSD,52
+https://github.com/Dreampie/Resty,9ef059c065d1894c79e7d69c150e588a61eb1cd5,Apache-2.0,36
+https://github.com/drhenner/ror_ecommerce,23d8d43b2451d4317e6228ba2ba89656f795f9b1,MIT,32
+https://github.com/easzlab/kubeasz,a11f714d9484cb578815445b952a2f145a46cf91,Apache-2.0,97
+https://github.com/eddycjy/go-gin-example,28f372bf41f9e67a9cec5980fd1c365363064ebc,MIT,70
+https://github.com/elastic/elasticsearch-js,4933e3b9bec474511233f5a05819e493060a86e2,Apache-2.0,165
+https://github.com/elastic/terraform-provider-elasticstack,da908df64ade81d65130b92038bc84866eefeef5,Apache-2.0,44
+https://github.com/elasticdog/transcrypt,aea3ff83c7aea95b18e18839d5beb6da29b7548c,MIT,17
+https://github.com/encode/starlette,b6f3578bb2cf6c60e3efe110143409b47f368d36,BSD,48
+https://github.com/enquirer/enquirer,8d626c206733420637660ac7c2098d7de45e8590,MIT,19
+https://github.com/eshengsky/iBlog,c5cea74c31a5b5c070a8dba64d514bb04694db22,MIT,12
+https://github.com/express-validator/express-validator,f9da949926770f6ca35267973ee6d6823e9c199e,MIT,15
+https://github.com/fabric/fabric,0f8003afdd3e4a7e660f178106ff5137bf3782bd,BSD,15
+https://github.com/fossasia/pslab-webapp,624e56fcae939b11e4e671e0fbde816a9e17162c,Apache-2.0,4
+https://github.com/francescomalatesta/laravel-api-boilerplate-jwt,050a5fb6621a55b391e978243364983ba634ff92,MIT,23
+https://github.com/GantMan/ReactStateMuseum,130e12bf401f292350e105bc7358b65a362d6ea2,MIT,43
+https://github.com/git-ecosystem/git-credential-manager,87b3a1a746ace2a7439c158348c1e649c30958d3,MIT,126
+https://github.com/github-tools/github,540813873309d1889aa50e0708f10baf90b08890,BSD,20
+https://github.com/github/codeql,4f4cdf434b1256f62e36f2069772d1dd4e16bb82,MIT,59
+https://github.com/google/go-github,edaee9aa26ea0b2fedd961398433b8940b2afef1,BSD,67
+https://github.com/google/google-authenticator,51781910ae2bb1abf8ac51b290272f86f3651235,Apache-2.0,68
+https://github.com/googlearchive/android-credentials,b16282a49f3ce3977f326ad697bdd19d28bd66af,Apache-2.0,4
+https://github.com/grafana/tanka,60775d3573df333d1076a68f165d8c9ff4acd8b3,Apache-2.0,28
+https://github.com/heroku/legacy-cli,6f18521a258394bfb79e6b36f7160ad8559a8e16,MIT,37
+https://github.com/howtographql/howtographql,8a5ba66c36c453c82f86f6e2ff7cabd050268018,MIT,75
+https://github.com/httpie/httpie,350f973f705dc996af27d66fe02e03e2f1f99968,BSD,23
+https://github.com/iterative/dvc,3ca18cb400ddf916b996fb140c02c1509b8f37b2,Apache-2.0,43
+https://github.com/jaeles-project/jaeles,66b4635842550283a59580f8765daf5c653e5c16,MIT,14
+https://github.com/JetBrains/Exposed,d59247283dc8c1af019e3e2a8c75c7519d1fdb6d,Apache-2.0,23
+https://github.com/jitsi/jitsi-meet,4fc9aed708c58643f5e7c94917a99f662464ff11,Apache-2.0,345
+https://github.com/juice-shop/juice-shop,60f29bc153d42ed8629cf3f30c1de9334294fdeb,MIT,396
+https://github.com/justauth/JustAuth,41559fc95494235471039217ad9c3b3a79d006b7,MIT,15
+https://github.com/justcoding121/titanium-web-proxy,caa61eed7a315469857c6e946fc786f8d46d4517,MIT,23
+https://github.com/kataras/iris,8f9140b705011eea9a7344466362662f3106cd69,BSD,83
+https://github.com/kgrzybek/modular-monolith-with-ddd,37de06228f3f6f49de20a510d5349c784903b01f,MIT,14
+https://github.com/laradock/laradock,3d57064466e3232cecc6c47ebdf9ca164b8773c3,MIT,56
+https://github.com/LibertyGlobal/grafana,240cf63ba6ad8c07a137d1c01f5034ee90422379,Apache-2.0,226
+https://github.com/lightos/credmap,d86224760db6745b11ff4428191a39d262d5aafa,MIT,3
+https://github.com/llldddbbb/dbblog,4de7c712fc146a7ecf694d8ebfdb3d17ef7c8e56,Apache-2.0,34
+https://github.com/LonamiWebs/Telethon,6b53d45ce27510335f5f33db510a4ee4e3a29a91,MIT,46
+https://github.com/lucas-clemente/quic-go,af3e1008ad94c64d5a60d1d7b2ddc579bca4ca79,MIT,55
+https://github.com/LycheeOrg/Lychee-v3,f78e469b2a2a580926f0abfb88c8fc047d63a6ed,MIT,33
+https://github.com/mailgun/mailgun-php,ae9ee585a27206c759a5d3a830a1d981ddb634a5,MIT,2
+https://github.com/Meituan-Dianping/mpvue,6c5d78ee04f58c6d782c456dfcf0fe63c0b7f89b,MIT,57
+https://github.com/microsoft/Git-Credential-Manager-for-Mac-and-Linux,ba7264c4baee703c94017a2b3bc2fcb7327e033e,MIT,11
+https://github.com/microsoft/Git-Credential-Manager-for-Windows,40d49d9791cea8ad07904bdf901610ed5d8268ee,MIT,72
+https://github.com/microsoft/winfile,8995a6e3a72870e750d2b5959e6245884c21a95f,MIT,1
+https://github.com/nandorojo/solito,b414d36ef1db64d3301dbbe035e2db2f9f55f0a4,MIT,70
+https://github.com/nats-io/nats-server,59b27a7a7a7a495ee86dfcb2053583ead5633704,Apache-2.0,258
+https://github.com/NG-ZORRO/ng-zorro-antd,957d02d76b72ceca1c43a1dffe88b8f90aea0b45,MIT,60
+https://github.com/OAI/OpenAPI-Specification,851a6d18a08dc5700ddd761b6e130318d34e6708,Apache-2.0,24
+https://github.com/Panuon/PanuonUI.Silver,14eb1e10c93a67d962ef242d2f22ba6ccf004993,MIT,30
+https://github.com/phpseclib/phpseclib,b6988f8ced123b20e27c845df66a134f67d1ba1b,MIT,85
+https://github.com/PostgREST/postgrest,1b12b112a1e491f51e48e37d5d828e4a390de26b,MIT,57
+https://github.com/postmanlabs/postman-collection-transformer,724d6b35a6d36a618da1e095c84780bfea177377,Apache-2.0,288
+https://github.com/PowerShell/PSScriptAnalyzer,06f94fb84008902fcf540dbd31839ab3348078b8,MIT,12
+https://github.com/predis/predis,1d7ccb64ab689a5330e9e0940f4057d42342c991,MIT,45
+https://github.com/rabbitmq/rabbitmq-tutorials,a0b077109860bfb94684d2693d1b0a7d906308fb,Apache-2.0,38
+https://github.com/rancher/rancher,f05e87317d8257dcd7c327c1a5450285a214fd9b,Apache-2.0,44
+https://github.com/sahat/hackathon-starter,53e1ead2b52af28b385ee5ae2b144bca0fd80732,MIT,40
+https://github.com/scalikejdbc/scalikejdbc,396167c9d3d25b4ea6b69bf530b6fe1a773e022e,Apache-2.0,40
+https://github.com/sferik/twitter,97f075aadd405427ba3cb5801feb67bdd1af77ef,MIT,35
+https://github.com/shadowsocksr-backup/shadowsocksr,1ee344220afce9c8b2d031830d23bc6d8849c39c,Apache-2.0,18
+https://github.com/sherlock-project/sherlock,829cac07c8e155cc1844dc3a069dcf9283abf603,MIT,1
+https://github.com/Shopify/sarama,03b4a4f7a346ee383edea231dba53f005ca63a9c,MIT,56
+https://github.com/Shopify/shipit-engine,c50c4a400c543dcd738c88d1d56f52006fb597eb,MIT,53
+https://github.com/Shopify/shopify_app,83865800a274db78950b2235991cc79193231f22,MIT,50
+https://github.com/spring-projects/spring-security-oauth,265ee115a74cb1eb141b2902e31e3897ba9f73a0,Apache-2.0,74
+https://github.com/stripe/stripe-cli,c0c9fbd18517852f53c5c08a0f75d121eebb63b8,Apache-2.0,39
+https://github.com/swagger-api/swagger-core,2695c2e8f6b5f784db753c21cd7a6f2a9799409e,Apache-2.0,50
+https://github.com/swisskyrepo/PayloadsAllTheThings,ad9c15b82405ba9eed991f9823482c7799d5a2cc,MIT,97
+https://github.com/tal-tech/go-zero,5d86cc2f20a198d410fe94cfdf5d11b3cbfbab8d,MIT,47
+https://github.com/threedr3am/learnjavabug,04790a2ed2ec7a3a6eadb55004b5aa499bc8a75d,MIT,29
+https://github.com/timdorr/tesla-api,89c63a4e530e6b6a1992113b022b390fb8d47a79,MIT,142
+https://github.com/tpolecat/skunk,186096d9272a8a21614c99eab8e76a87aac5225d,MIT,48
+https://github.com/tweetstream/tweetstream,cae45e7e805157767141845d35a88c6e76b99192,MIT,10
+https://github.com/twilio/twilio-ruby,d58fb8d7382c1a452bf67f1efbd3dc53415f811b,MIT,117
+https://github.com/tymondesigns/jwt-auth,ab00f2d7cce5f043067aef7849cdc792de2df635,MIT,51
+https://github.com/vitessio/vitess,e6ab2daaf64df67c609c5b3c9203060448f480c4,Apache-2.0,7
+https://github.com/vueComponent/ant-design-vue-pro,44a9ee06748e9b18d611e6c8471b395f864de70a,MIT,42
+https://github.com/xkcoding/spring-boot-demo,71bd673772fba3e18105041284a7fe42933c1377,MIT,39
+https://github.com/xo/usql,ff6a33d39fc8fd768774a474131e6b37e7ad6924,MIT,61
+https://github.com/yahoo/mysql_perf_analyzer,94a9292bd4cf07062ec6211e8da9077079db0f79,Apache-2.0,45
+https://github.com/yeojz/otplib,147e67637377196e3c59cf93b12ac325aca76fac,MIT,49
+https://github.com/yinxin630/fiora,72c21a8a19a4e6d0329a9be1919ecc15eb9cd3c7,MIT,46
+https://github.com/z-song/laravel-admin,0ba9c9116178c8c6f2d49cfeed8c819f9a34397e,MIT,44
+https://github.com/zardus/ctf-tools,1f03b1127b9f2a5df7a4aa6a2e6af73de120b47e,BSD,6
+https://github.com/ziahamza/webui-aria2,dddf776a18b095ac373a22b28135c5dd6858496b,MIT,27