Topic starter
05/07/2026 9:27 pm
TL;DR: GitGuardian says attacker interest is shifting toward credentials on developer laptops, CI/CD runners, and other reachable environments, where plaintext secrets can still be exposed and abused across supply chain attack paths. The governance gap is not detection alone, but ownership, over-permissioned access, and remediation across NHI estates.
Editorial analysis by NHI Mgmt Group, based on content published by GitGuardian: “GitGuardian Platform Demo - July 29, 2026”.
Key questions
Q: What breaks when secrets are stored in plaintext on developer endpoints?
A: Plaintext secrets turn endpoints into identity exposure points because any person, process, or malware that reaches the device can potentially reuse the credential.
Q: Why do leaked NHI credentials create more risk than ordinary exposed strings?
A: Leaked NHI credentials can function as authenticated access, not just information.
Practitioner guidance
- Audit developer endpoints for secret residency Inventory laptops, workstations, and build runners for cached, copied, or embedded credentials that sit outside the vault lifecycle.
- Tie every exposed secret to an owner Require a named owner for each NHI credential so revocation and rotation do not stall after detection.
- Revoke and rotate leaked credentials immediately Treat discovered endpoint secrets as active credentials until they are rotated, revoked, or confirmed unusable across every reachable system.
Bottom line: Developer endpoints have become a practical secrets exposure zone, especially when CI/CD runners and local tooling store credentials outside normal governance controls.
What to expect at the briefing
GitGuardian's full demo covers the operational detail this post intentionally leaves for the source:
- Live walkthrough of secrets discovery across code, endpoints, CI/CD, and reachable environments
- Demonstration of remediation workflows for leaked credentials at scale
- Visibility into vaults, SaaS applications, and identity providers for ownership tracing
- How the platform presents ownership gaps and over-permissioned access patterns
👉 Watch GitGuardian's demo on developer endpoint secrets visibility and NHI governance →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
05/07/2026 9:30 pm
Endpoint secret visibility is now an NHI governance control, not just a detection feature. Developer laptops and CI/CD runners are no longer peripheral assets. They are part of the identity attack surface because they frequently hold credentials that can authenticate to cloud, SaaS, and internal systems. The practitioner implication is that NHI governance must extend to the places where credentials are created, copied, cached, and executed.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- The blast radius of the Salesloft-Drift OAuth supply chain attack was 10 times greater than earlier incidents in which attackers breached Salesforce directly.
A question worth separating out:
Q: Should organisations prioritise endpoint secrets over vault hardening?
A: Organisations should treat endpoint secrets and vault hardening as linked controls, but prioritise the exposure path that is most likely to produce usable credentials. A hardened vault does little if secrets are copied into developer environments, while endpoint controls are weaker if credentials remain broadly reusable. The right priority is the path that most reduces valid credential exposure.
👉 Read our full editorial: Developer endpoint secrets visibility and NHI governance