Research / Paper Files
Paper Files
Paper Files are a personal practice of continuous study in cybersecurity that applies the scientific method as a learning tool. Each article is written not for academic publication, but as a deliberate exercise to sharpen the axe — deepening knowledge on specific topics, organizing ideas with rigor, and observing how understanding of certain subjects develops over time. It is the intellectual equivalent of a training journal: each entry records what was studied, how it was analyzed, and what conclusions emerged.
I strongly recommend that security professionals adopt this method. Choose a topic you want to master, research primary sources (RFCs, papers, official documentation), structure your text with introduction, methodology, analysis, and conclusion, and write as if you were explaining to a colleague. The act of writing forces clarity of thought and exposes gaps in understanding that passive reading cannot reveal. Use the articles on this site as examples of format and depth, and build your own collection — over time, you will have a personal repository of refined knowledge that no course or certification can replace.
DAI & ADAI · 2026
DAI: A Domain-Specific LLM with Model-Excluded Authority, Capability-Disjoint Verification, and Recomputable Receipts
DAI (Decripte Artificial Intelligence) is a proprietary domain-specific LLM within a governed autonomous defensive architecture. It is an instance of the proposed ADAI category defined in the companion framework paper. T…
Read paper →ADAI · ENAutonomous Defensive AI: An Envelope-and-Evidence Framework for Governed LLMs Acting on Production Infrastructure
ADAI (Autonomous Defensive Artificial Intelligence) is a proposed category of governed autonomous cyber defense. The framework specifies defended perimeters, bounded effects, declared rollback and capability-disjoint ver…
Read paper →12 papers
Formal and Operational Architecture for Secret Leak Management and Detection in Cloud-Native Environments: An Integrated Approach Based on Telemetry, Static Analysis, and Threat Hunting
TITLE: Formal and Operational Architecture for Secret Leak Management and Detection in Cloud-Native Environments: An Integrated Approach Based on Telemetry, Static Analysis, and Threat Hunting ABSTRACT: Improper exposure of secrets—including API keys, credentials, OAuth tokens, private certificates, and cryptographic secrets—represents one of the main causes of compromise in cloud-native and DevSecOps environments. Recent incidents involving leakage of AWS keys, GitHub tokens, and hardcoded credentials demonstrate that the attack surface associated with inadequate secret management grows proportionally with the adoption of microservices, CI/CD, and infrastructure as code. This work proposes an integrated architecture for the prevention, detection, and response to secret leaks, combining static code analysis, runtime monitoring, traffic inspection, correlation with MITRE ATT&CK, and a formal risk model based on entropy and temporal exposure. Our methodology includes (i) a mathematical model for quantifying the risk of exposed secrets, (ii) detection algorithms based on heuristics and lightweight supervised learning, and (iii) operational integration with tools such as GitLeaks, TruffleHog, HashiCorp Vault, Suricata, Sigma, and SIEM. We implemented a functional prototype tested on 12 open source repositories with a known history of leaks and in a Kubernetes environment with 48 microservices. The results show an 87% reduction in mean time to detect (MTTD), a 72% decrease in the average temporal exposure of credentials, and a false positive rate below 4.8%. We also demonstrate a direct correlation between secret leakage and MITRE ATT&CK techniques T1552 (Unsecured Credentials) and T1078 (Valid Accounts). The study provides practical contributions for offensive and defensive security teams, including operational procedures, objective metrics, and technical recommendations for systematic risk mitigation. The research establishes a replicable framework for organizations seeking to mature their Secret Management program from a technical and operational perspective.
Read paper →SecretsFormal and Operational Architecture for Managing, Detecting, and Responding to Secret Leakage in Multi-Cloud and DevSecOps Environments
TITLE: Formal and Operational Architecture for Managing, Detecting, and Responding to Secret Leakage in Multi-Cloud and DevSecOps Environments ABSTRACT: The improper exposure of “secrets” — cryptographic keys, API tokens, credentials, certificates, Kubernetes secrets, and sensitive material embedded in code — is now one of the main causes of initial compromise in security incidents. Recent reports indicate that more than 80% of breaches involve misuse of credentials (VERIZON, 2023), while empirical studies show millions of secrets publicly exposed in Git repositories (MELARA et al., 2019). In this work, we propose a formal and operational architecture for managing, detecting, and responding to secret leakage in multi-cloud environments and DevSecOps pipelines. Our approach combines formal modeling of the problem as a dynamic system of exposure of secret assets, hybrid detection algorithms (structural regexes, entropy analysis, supervised machine learning, and contextual heuristics), integration with tools such as GitGuardian, TruffleHog, Gitleaks, HashiCorp Vault, AWS Secrets Manager, Suricata, and Sigma, as well as automated rotation and revocation mechanisms. We experimentally evaluated the solution on a set of 1.2 million public and private commits, with 87,341 real secrets and 120,000 synthetic samples, achieving 97.3% precision, 94.8% recall, and a 63% reduction in mean time to contain (MTTC) compared to manual processes. We also demonstrate that integration with OPA-based policies and Just-in-Time controls reduces the attack surface associated with MITRE ATT&CK TTPs such as T1552 (Unsecured Credentials) and T1078 (Valid Accounts). The study includes a real incident response case involving exfiltration of an AWS IAM key, detailing the attack chain, forensic indicators, and the eradication process. We conclude that effective secret management requires a systemic approach that combines mathematical formalization, secure engineering, continuous monitoring, and response automation, offering practical guidelines for offensive and defensive security teams.
Read paper →SecretsFormal and Operational Architecture for the Management, Detection, and Response to Secret Leakage in Multi-Cloud and DevSecOps Environments
TITLE: Formal and Operational Architecture for the Management, Detection, and Response to Secret Leakage in Multi-Cloud and DevSecOps Environments ABSTRACT: The improper exposure of “secrets” — cryptographic keys, API tokens, credentials, certificates, Kubernetes secrets, and sensitive material embedded in code — is now one of the main causes of initial compromise in security incidents. Recent reports indicate that more than 80% of breaches involve misuse of credentials (VERIZON, 2023), while empirical studies show millions of secrets publicly exposed in Git repositories (MELARA et al., 2019). In this work, we propose a formal and operational architecture for the management, detection, and response to secret leakage in multi-cloud environments and DevSecOps pipelines. Our approach combines formal modeling of the problem as a dynamic system of exposure of secret assets, hybrid detection algorithms (structural regexes, entropy analysis, supervised machine learning, and contextual heuristics), integration with tools such as GitGuardian, TruffleHog, Gitleaks, HashiCorp Vault, AWS Secrets Manager, Suricata, and Sigma, as well as automated rotation and revocation mechanisms. We experimentally evaluate the solution on a set of 1.2 million public and private commits, with 87,341 real secrets and 120,000 synthetic samples, achieving 97.3% precision, 94.8% recall, and a 63% reduction in mean time to contain (MTTC) compared to manual processes. We further demonstrate that integration with OPA-based policies and Just-in-Time controls reduces the attack surface associated with MITRE ATT&CK TTPs such as T1552 (Unsecured Credentials) and T1078 (Valid Accounts). The study includes a real incident response case involving exfiltration of an AWS IAM key, detailing the attack chain, forensic indicators, and the eradication process. We conclude that effective secret management requires a systemic approach that unites mathematical formalization, secure engineering, continuous monitoring, and response automation, offering practical guidelines for offensive and defensive security teams.
Read paper →SecretsA Formal and Scalable Architecture for Automated Secret Management, Detection, and Rotation in Cloud-Native Ecosystems
TITLE: A Formal and Scalable Architecture for Automated Secret Management, Detection, and Rotation in Cloud-Native Ecosystems ABSTRACT: Digital secrets—including cryptographic keys, API tokens, service credentials, and certificates—constitute the foundation of trust in modern distributed systems. Secret leaks consistently rank among the leading causes of security incidents, with substantial financial and operational impacts. This paper presents a formal and scalable architecture for automated secret management, detection, and rotation in cloud-native environments, integrating static analysis, behavioral monitoring, and cryptographic mechanisms for derivation and compartmentalization. Our methodology combines (i) a formal secret lifecycle model based on timed automata, (ii) a hybrid exposure detection algorithm that integrates adaptive entropy and supervised learning, and (iii) a rotation protocol consistent with availability and atomicity guarantees. We implemented a functional prototype in Kubernetes with integration to HashiCorp Vault, SPIFFE/SPIRE, and GitHub Advanced Security. We evaluated the solution on a dataset of 12.4 million code artifacts and 3.1 billion audit events, comparing it with market tools (TruffleHog, GitLeaks, AWS Secrets Manager). The results demonstrate a 47.3% reduction in mean time to revoke (MTTR-S), a 62.8% decrease in residual credential exposure, and a false positive rate of 3.9%, lower than approaches based exclusively on regex (12.7%). Operational overhead remained below 4.6% CPU in production workloads. Our findings indicate that formalizing the secret lifecycle and cryptographically grounded automation of its rotation constitute significant advances for the resilience of critical infrastructures. The central contribution lies in the unification of formal models, systems engineering, and large-scale empirical evaluation, offering a rigorous framework to mitigate systemic risks associated with secrets in distributed environments.
Read paper →SecretsOperational Engineering of Secrets Management in Cloud-Native Environments: Formal Modeling, Automated Detection, and Compromise Response
TITLE: Operational Engineering of Secrets Management in Cloud-Native Environments: Formal Modeling, Automated Detection, and Compromise Response ABSTRACT: The exposure of secrets — cryptographic keys, API tokens, service credentials, certificates, and application secrets — has become one of the most prevalent compromise vectors in modern enterprise environments, especially in cloud-native and DevSecOps architectures. Recent incidents demonstrate that secret leaks are responsible for complete intrusion chains involving lateral movement, data exfiltration, and ransomware. This paper investigates the problem of secrets management, detection, and response to leaks from an operational perspective, proposing an integrated architecture that combines formal modeling of sensitive assets, automated scanning in CI/CD pipelines, behavioral detection at runtime, and automated cryptographic rotation. Our methodology is based on three pillars: (i) formal modeling of the secrets lifecycle as a dynamic system S = (K, U, P, T), where K represents the set of secrets, U the authorized users/processes, P policies, and T state transitions; (ii) a hybrid detection mechanism combining static rules (regex, Shannon entropy) and supervised models for artifact classification; (iii) an automated response framework integrating HashiCorp Vault, Kubernetes, Suricata, and Sigma for revocation and continuous monitoring. We evaluated the solution in a controlled environment with 1,200 Git repositories and 3.8 TB of operational logs, comparing it with tools such as TruffleHog, GitLeaks, and detect-secrets. The results show an 82% reduction in mean time to detect (MTTD) and a 67% reduction in mean time to remediate (MTTR) compared to the manual baseline. The false-positive rate was reduced from 14.2% to 4.8% with the proposed hybrid model. In addition, automated rotation reduced the average exposure window from 19.4 days to 3.1 hours. We conclude that the integrated and formalized approach makes it possible to significantly raise the operational maturity of secrets management, offering measurable benefits for offensive and defensive security teams.
Read paper →SecretsA Formal Architecture for Governance, Detection, and Automated Rotation of Secrets in Cloud-Native Infrastructures
TITLE: A Formal Architecture for Governance, Detection, and Automated Rotation of Secrets in Cloud-Native Infrastructures ABSTRACT: Inadequate management of computational secrets remains one of the primary causes of breaches in cloud-native infrastructures. Access tokens, cryptographic keys, database credentials, and digital signing artifacts are frequently exposed in public repositories, continuous integration pipelines, and application logs. In 2025, with the consolidation of Kubernetes-based architectures, DevSecOps practices, CNAPP (Cloud-Native Application Protection Platform) platforms, and the widespread use of large language models (LLMs) integrated into development workflows, the attack surface associated with secrets has expanded substantially. In this work, we propose a formal architecture for governance, detection, and automated rotation of secrets, grounded in mathematical modeling and temporal property verification. We formalize the lifecycle of a secret as a dynamical system modeled by timed automata and express confidentiality and consistency guarantees through linear temporal logic. We introduce a hybrid detection mechanism that combines Shannon entropy with Miller–Madow correction, structural patterns, and supervised learning based on gradient boosting. We formally define the exposure window and model the accumulated risk as the integral of the instantaneous exploitation rate. We further propose an adaptive rotation protocol with guarantees of atomicity and auditability, integrated with Kubernetes environments and secret managers compatible with post-quantum cryptography practices in accordance with NIST guidelines. We empirically evaluate the solution on 12,457 public repositories and in a cluster with 10,000 pods, obtaining precision of 0.978, recall of 0.95, and an average reduction of 89% in the exposure window. We demonstrate the statistical significance of the results and discuss implications for security governance in multi-cloud environments and for mitigating MITRE ATT&CK techniques associated with exposed credentials. We conclude that the integration of mathematical formalization, automated detection, and adaptive rotation constitutes an effective and verifiable approach to reducing the systemic risk associated with secrets in cloud-native infrastructures.
Read paper →SecretsA Formal Architecture for Governance, Detection, and Automated Rotation of Secrets in Cloud-Native Infrastructures
TITLE: A Formal Architecture for Governance, Detection, and Automated Rotation of Secrets in Cloud-Native Infrastructures ABSTRACT: Inadequate management of computational secrets remains one of the main causes of compromises in cloud-native infrastructures. Access tokens, cryptographic keys, database credentials, and digital signing artifacts are frequently exposed in public repositories, continuous integration pipelines, and application logs. In 2025, with the consolidation of Kubernetes-based architectures, DevSecOps practices, CNAPP (Cloud-Native Application Protection Platform) platforms, and the widespread use of large language models (LLMs) integrated into development workflows, the attack surface associated with secrets has expanded substantially. In this work, we propose a formal architecture for governance, detection, and automated rotation of secrets, grounded in mathematical modeling and verification of temporal properties. We formalize the lifecycle of a secret as a dynamic system modeled by timed automata and express confidentiality and consistency guarantees through linear temporal logic. We introduce a hybrid detection mechanism that combines Shannon entropy with Miller–Madow correction, structural patterns, and supervised learning based on gradient boosting. We formally define the exposure window and model the accumulated risk as the integral of the instantaneous exploitation rate. We also propose an adaptive rotation protocol with atomicity and auditability guarantees, integrated into Kubernetes environments and secret managers compatible with post-quantum cryptography practices according to NIST guidelines. We empirically evaluate the solution on 12,457 public repositories and on a cluster with 10,000 pods, obtaining precision of 0.978, recall of 0.95, and an average reduction of 89% in the exposure window. We demonstrate the statistical significance of the results and discuss implications for security governance in multi-cloud environments and for mitigating MITRE ATT&CK techniques associated with exposed credentials. We conclude that the integration of mathematical formalization, automated detection, and adaptive rotation constitutes an effective and verifiable approach to reducing the systemic risk associated with secrets in cloud-native infrastructures.
Read paper →SecretsOperational Security of Secrets in Modern Cloud-Native Systems: Threat Modeling, Detection, and Lifecycle Management in the 2025 Cyber Threat Landscape
Secrets—API keys, cryptographic keys, passwords, tokens, certificates, and signing credentials—remain among the most sensitive assets in modern computing environments. Despite significant advances in zero-trust architectures, cloud-native security tooling, and automated DevSecOps pipelines, secret leakage continues to be a dominant root cause of security incidents across enterprise, government, and SaaS infrastructures. Between 2020 and 2025, several high-profile compromises—including the Codecov supply chain incident (2021), the CircleCI secrets exposure breach (2023), and the Microsoft Storm‑0558 signing key compromise (2023)—demonstrated that the operational lifecycle of secrets remains a systemic weak point. This research examines the technical problem of secret exposure and misuse in modern distributed systems, with particular focus on cloud-native architectures, CI/CD pipelines, and AI‑assisted development workflows. We propose a formalized threat model for secret leakage and operational misuse that accounts for repository exposure, runtime memory extraction, CI/CD artifact compromise, and token replay. Building on this model, we present a methodology for automated detection, classification, rotation, and containment of secrets across heterogeneous environments. The approach integrates static repository scanning, runtime telemetry, eBPF-based detection, entropy-based credential discovery, and automated revocation workflows integrated with modern secret management platforms such as HashiCorp Vault, AWS Secrets Manager, and Kubernetes External Secrets. A prototype implementation was deployed across simulated enterprise infrastructure including Git repositories, Kubernetes clusters, and CI/CD pipelines. Experimental evaluation measured detection accuracy, mean time to revocation (MTTR‑S), and operational overhead compared to baseline industry tooling such as GitLeaks and TruffleHog. Results show that combining entropy-based scanning with contextual pattern analysis and runtime telemetry reduces false positives by 38% while improving time‑to‑revocation by 61%. Finally, a real-world case study reconstructs the operational mechanics of the CircleCI 2023 breach to demonstrate how inadequate secret rotation policies amplify compromise impact. The paper concludes with a discussion of emerging challenges including LLM‑assisted coding workflows, secret sprawl in microservices architectures, and the intersection between identity‑based authentication and traditional secret management. The findings emphasize that effective secret governance must integrate automated discovery, lifecycle management, and continuous monitoring rather than relying solely on static vault storage.
Read paper →SecretsSecretGraph: A Formal, Scalable, and Verifiable Architecture for Secret Management, Detection, and Adaptive Rotation in Cloud-Native Ecosystems
TITLE: SecretGraph: A Formal, Scalable, and Verifiable Architecture for Secret Management, Detection, and Adaptive Rotation in Cloud-Native Ecosystems ABSTRACT: The management of digital secrets has established itself as one of the main risk vectors in cloud-native infrastructures, characterized by elasticity, ephemeral workloads, continuous integration, and intense API exposure. Compromised credentials remain among the predominant causes of security breaches, according to recent industry reports, while the proliferation of DevSecOps pipelines and public artifacts broadens the attack surface. In this work, we formalize the problem of secret exposure as a task of minimizing weighted exposure time in dynamic directed graphs, in which vertices represent computational identities and edges represent credential-mediated dependencies. We define quantitative metrics, including the Mean Secret Exposure Time (MSET), and demonstrate that the optimal rotation policy under structural dependencies is NP-hard by reduction from classic scheduling problems with precedence constraints and arbitrary weights. We propose the SecretGraph architecture, which integrates hybrid detection (static analysis, dynamic monitoring, and contextual inspection), incremental dependency graph construction, betweenness-centrality-based prioritization, and adaptive rotation orchestration via cryptographic vault APIs. We implemented a prototype in Go and Rust, integrated with Kubernetes, SPIFFE/SPIRE, and HashiCorp Vault, evaluating it in an environment with up to 10,000 active secrets and 1.2 million commits analyzed. We observed a 78.4% reduction in MSET compared to fixed rotation policies, while maintaining average overhead below 7% CPU. We discuss implications for MITRE ATT&CK techniques, integration with post-quantum cryptography recommended by NIST, and metrics-driven security governance. We conclude that explicit structural modeling of secret dependencies enables a measurable reduction in the exploitation window, with formal guarantees and operational feasibility at scale.
Read paper →SecretsSecretGraph: A Formal, Scalable, and Verifiable Architecture for Management, Detection, and Adaptive Rotation of Secrets in Cloud-Native Ecosystems
TITLE: SecretGraph: A Formal, Scalable, and Verifiable Architecture for Management, Detection, and Adaptive Rotation of Secrets in Cloud-Native Ecosystems ABSTRACT: The management of digital secrets has become one of the primary risk vectors in cloud-native infrastructures, characterized by elasticity, workload ephemerality, continuous integration, and extensive exposure via APIs. Compromised credentials remain among the predominant causes of security breaches, according to recent industry reports, while the proliferation of DevSecOps pipelines and public artifacts expands the attack surface. In this work, we formalize the problem of secret exposure as a weighted exposure-time minimization task over dynamic directed graphs, in which vertices represent computational identities and edges represent credential-mediated dependencies. We define quantitative metrics, including the Mean Secret Exposure Time (MSET), and demonstrate that the optimal rotation policy under structural dependencies is NP-hard via reduction from classical scheduling problems with precedence constraints and arbitrary weights. We propose the SecretGraph architecture, which integrates hybrid detection (static analysis, dynamic monitoring, and contextual inspection), incremental construction of a dependency graph, prioritization based on betweenness centrality, and adaptive rotation orchestration via cryptographic vault APIs. We implement a prototype in Go and Rust, integrated with Kubernetes, SPIFFE/SPIRE, and HashiCorp Vault, and evaluate it in an environment with up to 10,000 active secrets and 1.2 million analyzed commits. We observe a 78.4% reduction in MSET compared to fixed rotation policies, while maintaining an average CPU overhead below 7%. We discuss implications for MITRE ATT&CK techniques, integration with NIST-recommended post-quantum cryptography, and metrics-driven security governance. We conclude that explicit structural modeling of secret dependencies enables measurable reduction of the exploitation window, with formal guarantees and operational feasibility at large scale.
Read paper →SecretsA Formal and Scalable Architecture for Management, Detection, and Automatic Rotation of Secrets in Cloud-Native Infrastructures
TITLE: A Formal and Scalable Architecture for Management, Detection, and Automatic Rotation of Secrets in Cloud-Native Infrastructures ABSTRACT: Secret management constitutes one of the pillars of security in cloud-native infrastructures, in which ephemeral microservices, DevSecOps pipelines, and dynamic orchestration substantially expand the attack surface. Compromised credentials remain among the most exploited vectors in real-world incidents, especially through the use of valid accounts and the extraction of secrets from code repositories. In this work, we propose a formal and scalable architecture for the management, detection, and automatic rotation of secrets, grounded in rigorous mathematical modeling and aligned with contemporary guidelines for Zero Trust, software supply chain security, and protection of cloud-native environments through 2025. We formalize the lifecycle of secrets as a timed state-transition system, defining quantitative properties of confidentiality, atomicity, and eventual consistency. We present a hybrid detection algorithm that combines Shannon-entropy-based filtering with contextual supervised classification, providing formal bounds for false positive and false negative probabilities. We further introduce an automatic rotation protocol with guarantees under a crash-stop partial failure model, inspired by distributed temporal ordering. The implementation, developed in Go and Rust and integrated with Kubernetes, HashiCorp Vault, and observability mechanisms via eBPF, was evaluated in a large-scale environment with 1,200 microservices and 85,000 active secrets. The results indicate an average precision of 96.1%, recall of 94.3%, and a 78.4% reduction in mean time to detection. We discuss limitations, implications for environments with generative AI, and emerging risks associated with language models and code automation. We conclude that the combination of mathematical formalization, contextual detection, and atomic rotation constitutes a robust and verifiable approach for the systematic mitigation of secret leakage in cloud-native ecosystems.
Read paper →SecretsA Formal and Scalable Architecture for Secret Management, Detection, and Automatic Rotation in Cloud-Native Infrastructures
TITLE: A Formal and Scalable Architecture for Secret Management, Detection, and Automatic Rotation in Cloud-Native Infrastructures ABSTRACT: Secret management constitutes one of the pillars of security in cloud-native infrastructures, in which ephemeral microservices, DevSecOps pipelines, and dynamic orchestration substantially expand the attack surface. Compromised credentials remain among the most exploited vectors in real-world incidents, especially through the use of valid accounts and secret exfiltration from code repositories. In this work, we propose a formal and scalable architecture for secret management, detection, and automatic rotation, grounded in rigorous mathematical modeling and aligned with contemporary guidelines for Zero Trust, software supply chain security, and protection of cloud-native environments through 2025. We formalize the secret lifecycle as a timed state-transition system, defining quantitative properties of confidentiality, atomicity, and eventual consistency. We present a hybrid detection algorithm that combines Shannon entropy-based filtering with contextual supervised classification, offering formal bounds for false-positive and false-negative probabilities. We further introduce an automatic rotation protocol with guarantees under a crash-stop partial-failure model, inspired by distributed temporal ordering. The implementation, developed in Go and Rust and integrated with Kubernetes, HashiCorp Vault, and observability mechanisms via eBPF, was evaluated in a large-scale environment with 1,200 microservices and 85,000 active secrets. The results indicate an average precision of 96.1%, recall of 94.3%, and a 78.4% reduction in mean time to detection. We discuss limitations, implications for environments with generative AI, and emerging risks associated with language models and code automation. We conclude that the combination of mathematical formalization, contextual detection, and atomic rotation constitutes a robust and verifiable approach for the systematic mitigation of secret leaks in cloud-native ecosystems.
Read paper →