Topic starter
13/10/2026 10:40 am
TL;DR: GitGuardian frames the credential layer as the pressure point for 2026, citing 28.7 million new secrets exposed on public GitHub in 2025 and AI-assisted developers leaking secrets at twice the usual rate. The governance problem is no longer discovery alone; runtime access, identity sprawl, and agentic code generation now define the attack surface.
Editorial analysis by NHI Mgmt Group, based on content published by GitGuardian: “SecDays NYC 2026”.
Key questions
Q: How should teams reduce secrets exposure in AI-assisted development?
A: Start by treating AI-assisted development as a new source of credential creation.
A: When secrets are scattered, organisations usually lose auditability, slow down remediation, and create inconsistent rotation and revocation practices.
Practitioner guidance
- Map credential creation points Inventory every place secrets are created or introduced, including repositories, CI/CD pipelines, AI-assisted coding tools, and business-user automation.
- Shorten secret lifetime Replace long-lived credentials with short-lived alternatives wherever the use case allows, and tie revocation to task completion, environment teardown, or offboarding events.
- Review AI-assisted development paths Add controls for generated code, copied snippets, and prompt-driven workflows so security teams can detect when secrets are introduced outside normal engineering review.
Bottom line: The article frames secrets exposure as a governance problem that spans software development, AI-assisted code generation, and identity control.
What to expect at the briefing
GitGuardian's full event page covers the agenda and speaking program this post intentionally leaves at a higher level:
- Session timing and format for the half-day SecDays NYC summit in New York
- Fireside chat agenda on governing the agentic enterprise and measuring emerging AI access risk
- Two focused presentations on credential security at scale and where GitGuardian says the field is heading
- Networking and registration details for security leaders attending by invitation
👉 Register for GitGuardian's SecDays NYC summit on the credential layer and AI-era security →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
13/10/2026 10:40 am
Secrets governance is becoming a software-production discipline, not a vaulting exercise. The article’s framing around the credential layer reflects a broader shift: secrets now originate in development tools, AI-assisted workflows, and business-user experimentation, not just in formal engineering teams. That means the control problem is distributed across creation, propagation, and reuse. Organisations that still treat secrets as a back-office hygiene task will miss the real governance boundary.
A question worth separating out:
Q: How do identity teams know whether secrets governance is actually working?
A: Identity teams know secrets governance is working when they can prove that every active secret has an owner, an approved scope, and a tested revocation path. If they cannot quickly identify where a secret is used or remove it without breaking the workload, governance is still incomplete.
👉 Read our full editorial: SecDays NYC frames secrets sprawl and agentic access risk for 2026