Topic starter
25/09/2026 5:31 pm
TL;DR: OWASP France is hosting an in-person AppSec meetup at GitGuardian’s Paris headquarters on October 5, bringing talks, discussion, and networking to practitioners focused on application security and secrets security, according to GitGuardian. The event underscores how exposed secrets and stolen credentials remain a live governance problem, not just a technical cleanup task.
NHIMG editorial: here’s why we think this discussion matters
Questions worth separating out
Q: What breaks when exposed credentials are not revoked quickly?
A: Exposed credentials create a standing access window that attackers can exploit before defenders notice.
Q: Why do exposed machine secrets create more risk than ordinary code leaks?
A: Because a secret is not just data, it is a credential.
Practitioner guidance
- Define secret ownership across AppSec and IAM Assign one accountable owner for each class of machine secret, including where it is created, stored, rotated, and revoked.
- Shorten the exposure-to-revocation window Measure how long exposed credentials remain valid after discovery and set a target to reduce that interval.
- Scan the full software delivery path for secrets Check source control, pull requests, CI logs, artifact stores, and runtime configuration for credentials that can still authenticate.
What to expect at the briefing
GitGuardian's full event page covers the logistics and community details this post intentionally leaves out:
- Exact meetup timing, venue details, and registration flow for attending in Paris
- Community-facing context on OWASP France and the type of practitioners who typically join
- The event framing around secrets security and AppSec discussions at GitGuardian HQ
- The on-page registration experience and attendee sign-up path
👉 Register for GitGuardian's OWASP France meetup in Paris on October 5 →
OWASP France meetup in Paris: what AppSec teams should expect?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
25/09/2026 5:31 pm
Secrets security is now an identity governance issue, not just an AppSec hygiene issue. Exposed secrets act as bearer credentials, which means possession often equals access. That collapses the normal authentication model and makes lifecycle control more important than perimeter control. For identity programmes, the operational lesson is straightforward: if a secret can authenticate a workload, it must be governed like an identity.
A question worth separating out:
Q: What is the difference between secret scanning and secret rotation?
A: Secret scanning finds exposed credentials, while secret rotation invalidates the secret and replaces it with a new one. Scanning without rotation only identifies the problem. Rotation without discovery misses hidden exposures. Effective governance needs both, because detection without invalidation leaves the identity still usable.
👉 Read our full editorial: OWASP France meetup on secrets security lands in Paris, October 5
