Show HN: SecMask – a 66M parameter model for finding secrets in source code (github.com)

A new model named SecMask has been introduced, leveraging a DistilBERT token-classification architecture to detect sensitive information such as credentials and tokens within source code and text. With 66 million parameters, SecMask complements traditional rule-based scanners by addressing context-dependent secrets that are often missed by regex patterns. The model's performance has been benchmarked against leading tools, such as gitleaks and Semgrep, demonstrating superior capabilities in non-pattern code detection while holding competitive results in regex-friendly contexts. Significantly, SecMask's design allows it to handle long inputs through a sophisticated manual sliding window approach, ensuring effective processing of documents beyond standard token limits. With an operating point set at τ = 0.99 for stringent accuracy, this model offers precise character span outputs, which detail the location and value of detected secrets. Released on Hugging Face under MIT and Apache-2.0 licenses, SecMask signals a pivotal advancement for developers and security analysts looking to enhance their code scanning tools with AI-driven insights.