Carlin is a GitHub Product Manager focused on GitHub Advanced Security and Dependabot. Her experience in software engineering and data science supports a data-driven approach to product management.
### Professional Background
- Works on GitHub Advanced Security.
- Focuses specifically on Dependabot.
- Brings experience in software engineering and data science.
### Personal Interests
- Lives in Washington with her partner and dog, Cookie.
- Enjoys cycling and competitive board games.
No technical blog post content was provided beyond this author biography.
GitHub’s improved security-token format demonstrated that fixed signatures and checksums can sharply reduce both false positives and missed secret detections. Microsoft applies these ideas across its services and proposes the open-source Common Annotated Security Standard (CASK), a shared format for identifiable secrets. CASK is intended to make scanning faster, more accurate, and easier to apply across an entire ecosystem without disrupting developers.
## Identifiable Secrets and Better Detection
- “Identifiable” keys combine:
- A fixed signature that reliably identifies the format.
- A checksum that validates whether a detected string is a real key.
- These features reduce scanner noise and missed findings.
- Microsoft can hard-block identifiable keys from being stored in source code, work items, and similar locations with high confidence.
- Scanners can detect the common format first and classify the specific service provider later, if needed.
## The Common Annotated Security Standard
- CASK defines platform-agnostic requirements for minted security keys.
- It reserves space for individual platforms and providers to encode service-specific metadata.
- Microsoft has defined Azure-specific metadata within this reserved area.
- A shared standard lowers the effort required for security tools to protect multiple service providers.
- Other providers can adopt the same core format.
## CASK Key Requirements
### Alphanumeric Encoding
- Keys use only the BASE62 alphabet.
- Avoiding special characters allows keys to be transmitted without escaping or additional encoding.
### Strong Entropy
- Each key contains 52 randomized encoded characters.
- This provides approximately 310 bits of entropy.
- The design is intended to prevent brute-force attacks, including in a post-quantum environment.
### Fixed Signatures
- Every CASK key includes:
- The standard signature `JQQJ`.
- A provider-specific signature.
- Microsoft observed `JQQJ` to be rare in both open-source and internal code, enabling fast and accurate detection.
- Azure DevOps uses `AZDO` as its provider signature.
- These signatures allow tools to detect CASK keys generically while still supporting provider-specific classification.
### Metadata and Testing Support
- Keys include their creation month and year.
- Timestamps support incident response and key-rotation enforcement.
- CASK reserves dedicated test keys so developers can test scanners and security controls without exposing real credentials.
- Microsoft plans to provide more details about Azure-specific metadata.
Microsoft recommends that service providers adopt CASK and contribute feedback as the standard evolves.
