Topic starter
13/10/2026 10:40 am
TL;DR: GitGuardian says SecDays San Francisco on December 10, 2026 is an executive summit focused on securing the credential layer as AI agents generate code and credentials and employees increasingly “vibe code,” while 28.7 million new secrets were exposed on public GitHub in 2025. The identity problem is no longer just secret storage; it is governance for creation, use, and exposure in AI-shaped development workflows.
Editorial analysis by NHI Mgmt Group, based on content published by GitGuardian: “SecDays San Francisco 2026”.
Key questions
Q: What breaks when secrets are allowed into AI development workflows?
A: Secrets stop behaving like isolated credentials and start behaving like replicated content.
Q: Why do exposed developer credentials and secrets create such a high-risk path for attackers?
A: Exposed credentials matter because they bypass many defensive layers and give attackers immediate, legitimate-looking access.
Practitioner guidance
- Inventory secret creation points Map every workflow that can mint or copy secrets, including AI-assisted coding tools, CI/CD steps, chatops, and developer sandboxes.
- Assign ownership for AI-handled credentials Define who owns secrets when an AI agent, coding assistant, or automation flow introduces them into code or runtime systems.
- Shorten exposure windows Reduce the time a secret can remain valid after it is introduced into a repository, build artifact, or prompt-driven workflow.
Bottom line: AI-assisted development is changing where secrets originate, which means credential governance now starts before a secret ever reaches a vault.
What to expect at the briefing
GitGuardian's full event listing covers the operational detail this post intentionally leaves for the source:
- Session timing, agenda flow, and the in-person structure for San Francisco attendees
- The executive-facing fireside chat on governing the agentic enterprise and AI adoption
- Talks on the credential layer and where GitGuardian says AI agent and identity security now intersect
- Networking format and attendance details for security leaders who want the room-level discussion
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
13/10/2026 10:40 am
Credential creation is now a governance event, not a side effect of coding: When AI systems and non-specialist employees can generate application logic, the act of creating a secret becomes part of identity governance. That expands the control boundary from storage and rotation into authorisation for credential creation itself. Practitioners should treat secret issuance as a governed workflow, not an incidental development artifact.
A question worth separating out:
Q: How should organisations govern AI agents alongside human identity and device access?
A: Organisations should treat AI agents as a separate identity class with their own entitlement boundaries, logging expectations, and approval model. Human IAM controls often assume interactive sign-in and review cycles, which do not fit autonomous or programmatic access. The safer approach is to define actor-specific policy and verify which access paths can be delegated without expanding trust unnecessarily.
👉 Read our full editorial: GitGuardian SecDays San Francisco frames the credential layer for AI-era security