ARMOR: An Extensible Multi-Provider Secret Validation Framework for Automated Credential Verification in DevSecOps Pipelines

Abstract: Credential leakage through public repositories creates an urgent incident-response problem: detection tools identify candidate secrets but do not establish whether a credential remains active. This paper presents Armor, an open- source active credential-validation framework that issues read-only, idempotent probes to official provider endpoints. Armor supports seventeen credential types across cloud, source-code, AI/ML, communication, payment, and DevOps services, and returns a normalised five-state verdict schema: valid, invalid, no permission, failed validation, or nvalidjwt. Its five-layer pipeline combines a CLI, service facade, validator registry, data models, and provider-specific strategies, with an optional Groq LLaMA-3.3-70B triage agent for unstructured text. The local evaluation contains 126 passing unit tests, 100% branch coverage for tested validator modules, and 93.55% total package coverage.

Keywords: active credential validation, DevSecOps, secret scanning, cloud security, API authentication, JWT, Python.