Topic starter
12/05/2026 6:43 pm
TL;DR: Verizon’s 2025 DBIR found 441,000 secrets in public Git repositories, with JWTs making up 66% of exposed web-app infrastructure secrets and GitLab credentials half of exposed CI/CD and development tokens, showing how easily non-human identity exposure still drives compromise, according to Entro Security. Secrets governance fails when exposure, ownership, and rotation lag behind attacker access.
Editorial analysis by NHI Mgmt Group, based on content published by Entro Security: “Key Takeaways from Verizon’s 2025 DBIR”.
By the numbers:
- 39% were web-app infrastructure secrets, and 66% of those were JWTs.
- 32% were CI/CD and development tokens, with GitLab credentials alone making up half.
- The median time to remediate leaked secrets in public repositories was 94 days.
Key questions
Q: What breaks when leaked NHI secrets are not revoked quickly?
A: The credential remains a live authentication path long after exposure, which means attackers can turn a repository leak into authenticated access, API abuse, or lateral movement.
Q: Why do leaked secrets remain such a persistent NHI risk?
A: Leaked secrets persist because they are often embedded in code, pipelines, or collaboration tools, then left valid long enough for reuse.
Q: How do identity teams know whether secrets governance is actually working?
A: Identity teams know secrets governance is working when they can prove that every active secret has an owner, an approved scope, and a tested revocation path.
Practitioner guidance
- Inventory secrets by effective privilege Classify exposed tokens, JWTs, and service credentials by what they can actually access, not by where they were found.
- Automate revocation on exposure Connect secret discovery to immediate rotation or invalidation so a disclosed credential cannot remain usable for weeks.
- Attach ownership to every secret Require a named owner, recovery path, and revocation path for each credential so the team that receives the alert can act without searching for accountability.
Bottom line: Leaked secrets remain a direct compromise path because the credential itself can authenticate into production systems long after exposure.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/05/2026 6:43 pm
Leaked secrets are still standing identities, not just leaked data: Once a token or JWT escapes into code or a repository, it behaves like an addressable credential with its own lifecycle. The article shows that the real failure is not disclosure alone but the fact that the secret can continue to authenticate after disclosure. Practitioners should treat every exposed secret as a live identity until proven otherwise.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should teams do when a secret is compromised outside a code repository?
A: Teams should rotate the compromised key immediately, then trace where it was shared and used so related systems can be contained. They should also review adjacent tools and accounts for secondary exposure, because one leaked secret often reveals a wider trust path. Fast containment matters because remediation is resource intensive and affects engineering as well as security.
👉 Read our full editorial: Verizon DBIR shows leaked secrets still drive NHI compromise