Topic starter
08/12/2025 3:53 pm
TL;DR: Akeyless says leaked secrets, static privileges and delayed rotation keep software supply chains exposed because credentials embedded in code, configuration files and logs remain valid long enough for attackers to abuse them. The real weakness is governance that still treats secrets as durable assets instead of short-lived access material.
Editorial analysis by NHI Mgmt Group, based on content published by Akeyless: “The Secret to Securing your Software Supply Chain”.
Key questions
Q: What breaks when secrets are exposed in a software supply chain incident?
A: The immediate break is not just code integrity, but credential integrity.
Q: Why do static privileges increase supply chain compromise risk?
A: Static privileges increase risk because a stolen or guessed secret can remain valid long after the moment it was issued.
Q: How can teams tell whether secret rotation is actually reducing risk?
A: Teams should look at whether a rotated secret was ever exposed at runtime, whether it still works in downstream systems, and how quickly it can be revoked everywhere it matters.
Practitioner guidance
- Map secret sprawl across delivery paths Inventory where secrets appear in source repositories, build logs, configuration files and CI/CD variables, then classify each location by revocation risk and exposure duration.
- Shorten credential lifetime aggressively Replace standing secrets with dynamic or just-in-time credentials wherever pipelines, deployment tooling or service connections can tolerate on-demand issuance.
- Automate rotation for exposed secrets Set rotation triggers for any credential that appears in code, logs or tickets, and require revocation before the next deployment cycle can reuse it.
Bottom line: Secret sprawl turns repositories, logs and configuration files into ungoverned access surfaces that attackers can search and reuse.
What's in the full article
Akeyless' full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step explanation of how leaked secrets move from repositories into supply chain compromise paths
- Operational description of how encrypted vaulting supports secret storage across hybrid and multicloud environments
- Specific mechanics of high-frequency rotation and just-in-time access for human-to-machine and machine-to-machine flows
- How a centralised secrets platform surfaces unusual secret use for alerting and investigation
👉 Read Akeyless' analysis of secrets sprawl and static privileges in supply chains →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/10/2026 3:07 pm
Secret sprawl is a lifecycle problem, not just an exposure problem. The issue is that credentials are distributed into places where governance no longer sees them as identity material. Once a secret exists in code, logs or repository history, it behaves like unmanaged NHI access, not like a controlled asset. Practitioners should treat sprawl as a lifecycle failure that expands the attack surface across development and delivery.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Internal repositories are 6x more likely to contain secrets than public ones (32.2% vs 5.6%), contradicting the assumption that private repos are safe, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What should organisations do when software delivery depends on long-lived secrets?
A: They should move high-risk connections toward just-in-time access and governed policy-based issuance. If the workflow still requires standing credentials, teams should limit their scope, reduce their lifetime and tie them to explicit approval and expiry. The goal is to make stolen access expire faster than an attacker can use it.
👉 Read our full editorial: Secrets sprawl and static privileges still fuel software supply chains