Secrets eradication is the practice of reducing or removing stored credentials such as passwords, API keys, and tokens from code, configuration, and other vulnerable locations. The aim is to replace static secrets with stronger identity-based controls that are easier to govern, audit, and revoke across modern infrastructure.
Expanded Definition
Secrets eradication is the discipline of removing static credentials from the places attackers and developers most often overlook: source code, build logs, configuration files, collaboration tools, and ephemeral runtime artifacts. In NHI security, the goal is not merely to hide secrets better, but to replace them with identity-based controls that can be authenticated, scoped, rotated, and revoked with far less operational friction.
Usage in the industry is still evolving. Some teams treat secrets eradication as a code hygiene task, while others frame it as a broader control-plane redesign that shifts authentication from shared strings to workload identity, federation, and short-lived credentials. The distinction matters because a repository scan can find hardcoded secrets, but it cannot by itself eliminate the architecture that keeps recreating them. The OWASP Non-Human Identity Top 10 treats poor secret handling as part of the wider NHI attack surface, where static credentials become durable failure points rather than temporary implementation details. NHI Management Group also documents how secret exposure repeatedly appears in supply chain and CI/CD compromise patterns in the CI/CD pipeline exploitation case study and the Guide to the Secret Sprawl Challenge.
The most common misapplication is treating secret scanning as eradication, which occurs when teams delete one exposed value without changing the workflow that continues to create and store static credentials.
Examples and Use Cases
Implementing secrets eradication rigorously often introduces migration and compatibility constraints, requiring organisations to weigh faster incident response against the engineering effort needed to rework legacy authentication paths.
- A CI/CD system replaces long-lived cloud keys with workload identity and short-lived tokens so pipeline runners never persist reusable credentials.
- Developers move from API keys embedded in application settings to federated service identity, reducing the need to distribute secrets across repos and deployment manifests.
- Security teams remove credentials from chat threads and ticketing systems by enforcing approved secret intake paths and automatic revocation when exposure is detected, a pattern reflected in the Guide to the Secret Sprawl Challenge.
- A platform team uses cloud-native identity controls instead of shared passwords for machine access, aligning with guidance from the OWASP Non-Human Identity Top 10.
- Incident responders revoke an exposed token and then remove the underlying static-secret pattern from the workflow so the same credential does not reappear in the next release.
These use cases are most effective when paired with detection, ownership, and automated rotation rather than one-time cleanup.
Why It Matters in NHI Security
Secrets eradication matters because static credentials convert every codebase, pipeline, and collaboration workspace into a durable access path. Once a password, token, or API key is copied into a vulnerable location, it can be reused long after the original developer context has changed. That is why NHI Management Group highlights secret sprawl as a persistent control failure in modern software delivery, not a niche hygiene issue. In The State of Secrets Sprawl 2026, GitGuardian found that 64% of valid secrets leaked in 2022 are still valid and exploitable today, showing that detection without revocation leaves real exposure in place.
This is also why the problem extends beyond source code. Secrets leaked in Slack, Jira, Confluence, and CI/CD runners often reach attackers through the path of least resistance, especially when internal systems are assumed to be safer than public repositories. The pattern is visible in NHI breach narratives such as the Emerald Whale breach and the Mastra npm Supply Chain Attack, where exposed credentials enabled broader compromise.
Organisations typically encounter the cost of secrets eradication only after a leaked token is used in a breach, at which point replacing the static credential model becomes operationally unavoidable.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Addresses secret sprawl and weak credential handling across NHI assets. |
| NIST CSF 2.0 | PR.AA-01 | Credential lifecycle and identity assurance support secure access management. |
| NIST Zero Trust (SP 800-207) | SC-7 | Zero Trust limits reliance on shared secrets by verifying each access request. |
| NIST AI RMF | AI systems often leak secrets through prompts, logs, and tooling interactions. | |
| CSA MAESTRO | Agentic systems require secure credential handling for tool use and delegation. |
Shift workloads to authenticated, short-lived access paths instead of static shared credentials.
