{"id":"https://openalex.org/W7164554729","doi":"https://doi.org/10.1145/3806007.3810969","title":"When Documented APIs Expose Identifiers: Measuring Unauthenticated SSH Key Metadata in Self-Managed GitLab","display_name":"When Documented APIs Expose Identifiers: Measuring Unauthenticated SSH Key Metadata in Self-Managed GitLab","publication_year":2026,"publication_date":"2026-06-12","ids":{"openalex":"https://openalex.org/W7164554729","doi":"https://doi.org/10.1145/3806007.3810969"},"language":null,"primary_location":{"id":"doi:10.1145/3806007.3810969","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3806007.3810969","pdf_url":null,"source":null,"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 12th ACM International Workshop on Security and Privacy Analytics","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3806007.3810969","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5092793987","display_name":"Philipp Schubaur","orcid":"https://orcid.org/0009-0005-7046-7698"},"institutions":[{"id":"https://openalex.org/I142270456","display_name":"Technische Hochschule Augsburg","ror":"https://ror.org/016604a03","country_code":"DE","type":"education","lineage":["https://openalex.org/I142270456"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Philipp Schubaur","raw_affiliation_strings":["Technical University of Applied Sciences Augsburg, Augsburg, Germany"],"raw_orcid":"https://orcid.org/0009-0005-7046-7698","affiliations":[{"raw_affiliation_string":"Technical University of Applied Sciences Augsburg, Augsburg, Germany","institution_ids":["https://openalex.org/I142270456"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5080081574","display_name":"Peter Knauer","orcid":"https://orcid.org/0009-0009-9849-876X"},"institutions":[{"id":"https://openalex.org/I142270456","display_name":"Technische Hochschule Augsburg","ror":"https://ror.org/016604a03","country_code":"DE","type":"education","lineage":["https://openalex.org/I142270456"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Peter Knauer","raw_affiliation_strings":["Technical University of Applied Sciences Augsburg, Augsburg, Germany"],"raw_orcid":"https://orcid.org/0009-0009-9849-876X","affiliations":[{"raw_affiliation_string":"Technical University of Applied Sciences Augsburg, Augsburg, Germany","institution_ids":["https://openalex.org/I142270456"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5105094201","display_name":"Philipp Schloyer","orcid":"https://orcid.org/0009-0008-2272-1147"},"institutions":[{"id":"https://openalex.org/I142270456","display_name":"Technische Hochschule Augsburg","ror":"https://ror.org/016604a03","country_code":"DE","type":"education","lineage":["https://openalex.org/I142270456"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Philipp Schloyer","raw_affiliation_strings":["Technical University of Applied Sciences Augsburg, Augsburg, Germany"],"raw_orcid":"https://orcid.org/0009-0008-2272-1147","affiliations":[{"raw_affiliation_string":"Technical University of Applied Sciences Augsburg, Augsburg, Germany","institution_ids":["https://openalex.org/I142270456"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5042778157","display_name":"Dominik Merli","orcid":"https://orcid.org/0000-0003-2310-5895"},"institutions":[{"id":"https://openalex.org/I142270456","display_name":"Technische Hochschule Augsburg","ror":"https://ror.org/016604a03","country_code":"DE","type":"education","lineage":["https://openalex.org/I142270456"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Dominik Merli","raw_affiliation_strings":["Technical University of Applied Sciences Augsburg, Augsburg, Germany"],"raw_orcid":"https://orcid.org/0000-0003-2310-5895","affiliations":[{"raw_affiliation_string":"Technical University of Applied Sciences Augsburg, Augsburg, Germany","institution_ids":["https://openalex.org/I142270456"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I142270456"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.75037295,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"29","last_page":"39"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.09560000151395798,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.09560000151395798,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T11719","display_name":"Data Quality and Management","score":0.0868000015616417,"subfield":{"id":"https://openalex.org/subfields/1803","display_name":"Management Science and Operations Research"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.05550000071525574,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/expose","display_name":"EXPOSE","score":0.6814000010490417},{"id":"https://openalex.org/keywords/metadata","display_name":"Metadata","score":0.6780999898910522},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.6474999785423279},{"id":"https://openalex.org/keywords/term","display_name":"Term (time)","score":0.28850001096725464}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7182999849319458},{"id":"https://openalex.org/C2779137570","wikidata":"https://www.wikidata.org/wiki/Q16243196","display_name":"EXPOSE","level":2,"score":0.6814000010490417},{"id":"https://openalex.org/C93518851","wikidata":"https://www.wikidata.org/wiki/Q180160","display_name":"Metadata","level":2,"score":0.6780999898910522},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.6474999785423279},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.4081999957561493},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.29600000381469727},{"id":"https://openalex.org/C61797465","wikidata":"https://www.wikidata.org/wiki/Q1188986","display_name":"Term (time)","level":2,"score":0.28850001096725464},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.28450000286102295},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.2337999939918518},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.23180000483989716}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3806007.3810969","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3806007.3810969","pdf_url":null,"source":null,"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 12th ACM International Workshop on Security and Privacy Analytics","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3806007.3810969","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3806007.3810969","pdf_url":null,"source":null,"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 12th ACM International Workshop on Security and Privacy Analytics","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":8,"referenced_works":["https://openalex.org/W2050019454","https://openalex.org/W2947593054","https://openalex.org/W2968786810","https://openalex.org/W4307020337","https://openalex.org/W4366774502","https://openalex.org/W4391043723","https://openalex.org/W4402931959","https://openalex.org/W4416549403"],"related_works":[],"abstract_inverted_index":{"Self-managed":[0],"software":[1],"development":[2],"platforms":[3],"are":[4,34],"often":[5],"deployed":[6],"under":[7],"the":[8,38,58,72,79,160,166],"assumption":[9,22],"that":[10,173],"unauthenticated":[11,39,176],"access":[12,203],"is":[13,45,74],"limited":[14],"to":[15,47,140],"clearly":[16,76],"public":[17,49,53],"artifacts.":[18],"In":[19],"GitLab,":[20],"this":[21,125],"does":[23],"not":[24,75],"always":[25],"align":[26],"with":[27],"how":[28],"API":[29,73,177],"behavior":[30],"and":[31,144,163,194],"data":[32],"visibility":[33],"perceived.":[35],"We":[36,101],"analyze":[37],"REST":[40],"endpoint":[41,59],"/api/v4/users/":[42],"{uid}/keys,":[43],"which":[44],"documented":[46],"allow":[48],"retrieval":[50],"of":[51,107,142,146,159,165],"SSH":[52,136],"keys.":[54],"Beyond":[55],"key":[56,65,137],"material,":[57],"exposes":[60],"user-defined":[61],"metadata":[62],"such":[63,190],"as":[64,90,191],"titles,":[66],"whose":[67],"unauthenticated,":[68],"Internet-scale":[69],"retrievability":[70],"via":[71],"surfaced":[77],"by":[78],"web":[80],"interface.":[81],"As":[82],"a":[83,103,174],"result,":[84],"these":[85],"fields":[86],"can":[87,178],"be":[88],"used":[89],"internal":[91],"labels":[92],"in":[93,111],"practice,":[94],"despite":[95],"being":[96],"retrievable":[97],"from":[98],"Internet-reachable":[99],"deployments.":[100],"conduct":[102],"large-scale":[104],"Internet":[105,184],"measurement":[106],"self-managed":[108],"GitLab":[109],"instances":[110,131],"Western":[112],"Europe.":[113],"From":[114],"7872":[115],"publicly":[116],"reachable":[117],"login":[118],"interfaces,":[119],"4064":[120],"(51.6%)":[121],"were":[122],"API-reachable":[123,147],"for":[124],"endpoint.":[126],"Under":[127],"conservative":[128],"probing,":[129],"3475":[130],"returned":[132],"at":[133,183],"least":[134],"one":[135],"object,":[138],"corresponding":[139],"44.1%":[141],"login-reachable":[143],"85.5%":[145],"instances.":[148],"Across":[149],"affected":[150],"instances,":[151],"we":[152],"classified":[153],"4376":[154],"key-title":[155],"strings,":[156],"including":[157],"1466":[158],"form":[161,167],"username@hostname":[162],"1225":[164],"[email":[168],"protected].":[169],"Our":[170],"findings":[171],"show":[172],"documented,":[175],"expose":[179],"auxiliary,":[180],"user-supplied":[181],"identifiers":[182],"scale.":[185],"This":[186],"enables":[187],"low-effort":[188],"reconnaissance":[189],"domain":[192],"harvesting":[193],"targeted":[195],"contact":[196],"discovery,":[197],"enabling":[198],"organizational":[199],"inference":[200],"without":[201],"repository":[202],"or":[204],"authentication.":[205]},"counts_by_year":[],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2026-06-13T00:00:00"}