Comcast open-sources xGitGuard code protection tool

Comcast is releasing a new software tool, xGitGuard, as an open source project to the community at large. The tool is designed to proactively search the open source repositories of GitHub for code that was supposed to remain proprietary.

The idea behind xGitGuard is to provide an automated method of checking through GitHub repositories for code that shouldn’t be there — an important consideration for modern development teams, given the increasing usage of open source code. The tool uses NLP (natural language processing) technology, AI modeling and other advanced techniques to programmatically identify and validate secret code on GitHub, as well as identifying which developer accounts posted those secrets.

According to Bahman Rashidi, director of Comcast’s cybersecurity and privacy engineering research team, the key advantage to xGitGuard is its flexibility — it can be used both retroactively, to detect secrets uploaded after the fact, as well as proactively, to check code before it’s posted.

“Obviously, proactive is the ideal use case from a security standpoint, but there’s a lot of flexibility,” Rashidi says. “The tool can be utilized by both individual users on their servers/machines (e.g., developers can also scan local files and directories) or deployed at organization level in a cloud.”

Comcast asserted that the tool is more than 90% accurate in distinguishing secret code from non-secret text, and that the company has used xGitGuard for sometime in order to take advantage of GitHub’s utility as a software development resource while keeping proprietary code separate.

“The problem that xGitGuard was designed to solve is ubiquitous, so we thought it was a great candidate to make available open source,” Rashidi says. “GitHub is such a vital tool for developers, and so many people use it, that we really hope as many people/small or large organizations as possible make use of the technology.”

It’s not the company’s first foray into the world of open source software — Comcast has released more than 200 public repos to GitHub. Some of the more prominent include a content delivery network software framework called Traffic Control, an automated server maintenance tool called Bynar, and a Rust-based network function development framework called Capsule. And two more projects — Prometheus dashboard accelerator tool Trickster and Kubernetes cluster testing framework Kuberhealthy — were accepted into the Cloud Native Computing Foundation’s sandbox program last year.