Secrets Sentinel — xsmall-c2p-v1 (deberta-v3-xsmall (c2p only))

Variant of hypn05/secrets-sentinel Architecture: deberta-v3-xsmall (c2p only) · Parameters: 70M · Speed: 5.3× vs base · pos_att_type: c2p only (p2c dropped at init)

Experimental variant. c2p-only position attention (p2c weights dropped before fine-tuning). Full fine-tune on data_v10. Fastest variant but 5 false positives on short Terraform identifiers (e.g. identifier = "mydb") vs 0 for xsmall-v1. Use xsmall-v1 for production; this variant is for research/speed benchmarking.

Benchmark (test_cases_realistic · 700 lines · 9 scenarios · private_key excluded)

Model	F1	Prec	Rec	FP	ms/line	Speedup
base v5.0.0 (reference)	1.0000	1.0000	1.0000	0	0.938ms	1×
xsmall-c2p-v1 (this model)	see notes	—	1.0000	see notes	~5.3× faster	5.3×

Usage

from transformers import pipeline

detector = pipeline("text-classification", model="hypn05/secrets-sentinel-xsmall-c2p")

lines = [
    "AWS_SECRET_ACCESS_KEY = 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'",
    "password = os.environ.get('DB_PASSWORD')",
    "uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef",
    "DB_PASSWORD=null",
]

for line, result in zip(lines, detector(lines)):
    label = "SECRET" if result["label"] == "LABEL_1" else "safe  "
    print(f"[{label}] {result['score']:.1%}  {line[:70]}")

Expected output:

[SECRET] 100.0%  AWS_SECRET_ACCESS_KEY = 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'
[safe  ]   0.0%  password = os.environ.get('DB_PASSWORD')
[safe  ]   0.0%  uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef
[safe  ]   0.0%  DB_PASSWORD=null

Parent model

See hypn05/secrets-sentinel for full documentation, integration examples (pre-receive hooks, GitHub Actions, pre-commit), training data details, and complete benchmark numbers across all variants.