They treat broad preserve rules as a safe fallback, but those rules can weaken shrinking and obfuscation across far more code than necessary. That creates long-term security debt because the app remains functional while the protection posture becomes less precise and easier to reverse engineer.
Why Security Teams Misjudge Broad Keep Rules
Broad keep rules feel safe because they preserve functionality during refactoring, but they quietly expand the surface that remains readable, traceable, or recoverable. That is a problem when the protected code includes secrets handling, token logic, or obfuscation routines. NHI Mgmt Group notes that 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, which makes overbroad preservation decisions especially risky in real environments. Ultimate Guide to NHIs aligns with this concern by showing how identity and code exposure often travel together. Security teams often assume a broad keep rule is temporary, but temporary exceptions tend to become the default.
The core mistake is treating preservation as neutral. In practice, every extra file, symbol, or path that survives shrinking can provide an attacker with anchors for reverse engineering, credential discovery, or workflow mapping. The issue is not only code size, but also certainty: the more the build preserves, the easier it becomes to infer what matters and where to look. The NIST Cybersecurity Framework 2.0 pushes teams toward risk-informed protection, not blanket exceptions. In practice, many security teams encounter the damage only after a release has already shipped with far more retained detail than intended.
How Keep Rules Should Be Scoped in Practice
Keep rules should be narrow, testable, and tied to a documented reason. The goal is to preserve only what is required for runtime behavior, diagnostics, or compatibility, while allowing everything else to be renamed, removed, or folded away. The safest pattern is to define explicit allowlists for the few classes, methods, or resources that truly must remain stable, then validate the output against that intent.
Practitioners should think in terms of blast radius:
- Preserve only the minimum surface needed for reflection, serialization, plugin loading, or public API compatibility.
- Separate production rules from development convenience rules so temporary debugging settings do not become permanent exposure.
- Review keep rules alongside secrets handling, because code that remains readable can also reveal token names, endpoint patterns, and access flows.
- Measure whether the rule still exists for a current business need, not just because a past release once required it.
This is where broad keep rules often conflict with security objectives. If the application depends on obfuscation for deterrence, broad preservation weakens that deterrent across far more code than needed. The Ultimate Guide to NHIs is relevant here because exposed application logic often helps expose non-human identity workflows as well, including service accounts, API keys, and orchestration paths. Teams should also align the rule set with the principles in NIST Cybersecurity Framework 2.0 by validating that protection changes are intentional, reviewed, and traceable. These controls tend to break down when build pipelines rely on legacy compatibility rules because nobody revisits whether the preserved surface is still justified.
Common Exceptions, Tradeoffs, and Review Triggers
Tighter keep rules often increase engineering friction, requiring organisations to balance protection against compatibility and support cost. That tradeoff is real in systems that depend on reflection-heavy frameworks, dynamic loading, or customer-managed plugins. Best practice is evolving, and there is no universal standard for this yet, so teams need review criteria rather than fixed dogma.
Common edge cases include:
- Serialization frameworks that require stable field names for interoperability.
- Mobile or embedded builds where over-aggressive shrinking can break vendor libraries or device-specific code paths.
- Debug or staging builds that legitimately need more visibility than production builds.
- Regulated environments where traceability matters, but broad preservation still needs a least-exposure review.
Security teams should treat any keep rule as a control exception with an owner, expiry expectation, and periodic revalidation. A rule that was acceptable for one release may become unjustified after a dependency change, feature removal, or packaging update. The operational lesson from NHI Mgmt Group’s research is that exposure often persists because nobody revisits it, not because it is still needed. The more a rule protects convenience instead of function, the more likely it is to become permanent security debt. Current guidance suggests rechecking these rules whenever release behavior, dependency structure, or secret-handling patterns change materially.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 | Broad keep rules can expose NHI-related secrets and workflows in code. |
| NIST CSF 2.0 | PR.DS-1 | Preserving too much code weakens data protection and exposure minimization. |
| NIST AI RMF | GOVERN | Rule exceptions need ownership and review, which fits AI risk governance patterns. |
| CSA MAESTRO | SEC-02 | Agentic and automated pipelines need scoped controls that do not overexpose logic. |
Constrain build-time exceptions to the smallest necessary surface and document the reason.
