Redacting Sensitive Information in Software Artifacts

In the past decade, there have been many well-publicized cases of source code leaking from different well-known companies. These leaks pose a serious problem when the source code contains sen-sitive information encoded in its identifier names and comments. Unfortunately, redacting the sensitive information requires obfus-cating the identifiers, which will quickly interfere with program comprehension. Program comprehension is key for programmers in understanding the source code, so sensitive information is often left un-redacted. To address this problem, we offer a novel approach for REdact-ing Sensitive Information in Software arTifacts (RESIST). RESIST finds and replaces sensitive words in software artifacts in such a way to reduce the impact on program comprehension. We eval-uated RESIST experimentally using 57 professional programmers from over a dozen different organizations. Our evaluation shows that RESIST effectively redacts software artifacts, thereby mak-ing it difficult for participants to infer sensitive information, while maintaining a desired level of comprehension