Topic starter
10/09/2025 4:53 pm
TL;DR: GitGuardian’s State of Secrets Sprawl 2025 shows 23,770,171 new hardcoded secrets were added to public GitHub repositories in 2024, while 70% of secrets leaked in 2022 are still valid today. The governance failure is not discovery alone but the inability to revoke, scope, and expire non-human identities fast enough to shrink blast radius.
Editorial analysis by NHI Mgmt Group, based on content published by GitGuardian: “Secrets Sprawl 2025”.
By the numbers:
- 70% of the secrets leaked in 2022 are still valid today.
- 35% of all customers’ private repositories scanned contained at least one plaintext secret.
Key questions
Q: What breaks when exposed NHI secrets are left in public DevOps environments?
A: Publicly exposed NHI secrets break the assumption that internal trust boundaries still protect machine credentials.
Q: Why do leaked service credentials remain dangerous after they are discovered?
A: They remain dangerous because exposure and invalidation are separate events.
Q: How do identity teams know whether secrets governance is actually working?
A: Identity teams know secrets governance is working when they can prove that every active secret has an owner, an approved scope, and a tested revocation path.
Practitioner guidance
- Implement secret lifecycle ownership Assign a named owner for every credential, token, and key so that discovery triggers a clear revoke-or-rotate workflow rather than an informal cleanup task.
- Expand scanning beyond source control Scan Slack, Jira, Confluence, CI/CD logs, and container artefacts for secrets because the article shows leaks frequently originate outside repositories.
- Shorten the validity window Replace static credentials with short-lived secrets where possible and enforce expiry so leaked material becomes useless faster than adversaries can exploit it.
Bottom line: Secrets sprawl is a governance problem because leaked credentials often remain valid after discovery, which leaves the underlying non-human identity exposed to reuse.
What's in the full report
GitGuardian’s full report covers the operational detail this post intentionally leaves for the source:
- Breakdown of where secrets are leaking across public repositories, private repositories, collaboration tools, and container images
- Analysis of generic credentials versus more identifiable secret types, useful for prioritising detection strategy
- Examples of how GitHub Push Protection fails to cover several common secret formats
- The report’s practical recommendations for semi-automated expiration, rotation, and cross-vault governance
👉 Read GitGuardian’s State of Secrets Sprawl 2025 report on NHI governance risks →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
07/10/2026 6:22 pm
Secrets sprawl is now an identity governance problem, not a discovery problem. GitGuardian’s data shows that exposed credentials continue to circulate across repositories, collaboration tools, and images long after teams think they have contained them. The real failure is that organisations still separate secret detection from identity lifecycle control. The practitioner conclusion is that secrets management must be treated as NHI governance, not as a standalone hygiene task.
A few things that frame the scale:
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded, according to the State of Secrets Sprawl 2026.
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What is the difference between secret scanning and secrets management?
A: Secret scanning finds credentials that have been exposed, while secrets management controls how credentials are stored, issued, rotated, and revoked. Scanning is detective. Management is preventive and lifecycle-based. Strong programmes need both because discovery alone does not remove access.
👉 Read our full editorial: Secrets sprawl is widening the non-human identity governance gap