  Throughout 2021, GitGuardian's monitoring of public GitHub repositories
revealed a two-fold increase in the number of secrets (database credentials,
API keys, and other credentials) exposed compared to 2020, accumulating more
than six million secrets. To our knowledge, the challenges developers face to
avoid checked-in secrets are not yet characterized. The goal of our paper is to
aid researchers and tool developers in understanding and prioritizing
opportunities for future research and tool automation for mitigating checked-in
secrets through an empirical investigation of challenges and solutions related
to checked-in secrets. We extract 779 questions related to checked-in secrets
on Stack Exchange and apply qualitative analysis to determine the challenges
and the solutions posed by others for each of the challenges. We identify 27
challenges and 13 solutions. The four most common challenges, in ranked order,
are: (i) store/version of secrets during deployment; (ii) store/version of
secrets in source code; (iii) ignore/hide of secrets in source code; and (iv)
sanitize VCS history. The three most common solutions, in ranked order, are:
(i) move secrets out of source code/version control and use template config
file; (ii) secret management in deployment; and (iii) use local environment
variables. Our findings indicate that the same solution has been mentioned to
mitigate multiple challenges. However, our findings also identify an increasing
trend in questions lacking accepted solutions substantiating the need for
future research and tool automation on managing secrets.
