Notifications
Clear all
Topic starter
22/07/2026 4:34 pm
TL;DR: Developer laptops now hold credentials in config files, shell history, MCP configs, and AI coding agent artefacts, while endpoint scanning can reveal them and live validity checks can make findings actionable in real time, according to GitGuardian. The governance gap is no longer just repo scanning; identity teams have to treat the workstation as part of the credential attack surface.
NHIMG editorial — here’s why we think this discussion matters
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes , and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams find credentials on developer laptops?
A: Scan endpoint-local files that traditional repo scanners miss, including config files, shell history, cached tokens, MCP configs, and AI tool artefacts.
Q: Why do developer endpoints change NHI governance priorities?
A: Because credentials often move from governed systems into unmanaged local storage, which means the workstation becomes part of the identity attack surface.
Practitioner guidance
- Extend secret discovery to endpoints Inventory developer laptops and non-developer workstations for config files, shell history, cached tokens, and MCP artefacts that can hold live credentials.
- Tie findings to validity checks Verify whether a discovered credential is still active before opening a remediation queue, then revoke or rotate immediately when access is confirmed.
- Add AI tool artefacts to scope Include files and local caches created by AI coding assistants in secret scanning, because they can persist copied credentials and context data outside repo controls.
What to expect at the briefing
GitGuardian's full event covers the operational detail this post intentionally leaves for the source:
- A live walkthrough of where credentials appear on developer machines, including config files, shell history, MCP configs, and AI coding agent artefacts.
- Discussion of what endpoint scans can surface that repository-only tooling misses, with examples from real developer workflows.
- Explanation of how live validity checks make endpoint findings actionable for remediation and response.
- A practitioner view from Vermeer on what changed when credential visibility moved past the repo and onto the laptop itself.
👉 Register for GitGuardian's webinar on developer endpoint credential visibility →
Every laptop is a credential store, so what should IAM teams do?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
22/07/2026 4:39 pm
Endpoint secret exposure is now part of NHI governance, not just endpoint security. Once credentials live on laptops in config files, shell history, and AI tool artefacts, the workstation becomes a governed identity surface. That changes the scope of discovery, rotation, and offboarding because the control point is no longer only the vault or the repo. Practitioners should treat developer endpoints as first-class NHI inventory sources.
A few things that frame the scale:
- 23.7% of organisations share secrets through insecure methods such as email or messaging applications, according to The 2024 Non-Human Identity Security Report.
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities, which shows how shallow visibility still is across many programmes.
A question worth separating out:
Q: Should organisations treat AI coding tools as part of secret management?
A: Yes, because the artefacts around AI-assisted development can store or reveal credentials even when the model itself is not the identity system. The practical question is whether your discovery and response workflow includes those local artefacts. If it does not, your secret boundary is incomplete.
👉 Read our full editorial: Every laptop is a credential store in the AI coding era
