Notifications
Clear all
Topic starter
14/09/2026 10:10 am
TL;DR: Developer laptops are filling with plaintext credentials that never reach source control, leaving security teams to reconstruct exposure through days or weeks of forensics, according to GitGuardian. The control gap is not detection alone but the absence of a per-machine credential inventory that can prove what was on the device, what was harvested, and what coverage an auditor can test.
NHIMG editorial — what this means for NHI practitioners
By the numbers:
- GitGuardian says its early access program found that a 95-day window matters after an incident when local credentials remain discoverable on developer machines.
Questions worth separating out
Q: What breaks when developer workstation secrets are not inventoried?
A: Without a workstation-level inventory, security teams cannot quickly prove which credentials were present on a compromised laptop, which ones were still active, or how far the exposure spread.
Q: Why do developer credentials create supply-chain risk beyond repository access?
A: Because those credentials often control release, signing, and marketplace distribution, not just source-code access.
Q: How do security teams know if secrets governance is actually working on developer workstations?
A: Secrets governance is working when sensitive material is not recoverable from local paths, environment variables, or build scripts, and when imported dependencies cannot read them without triggering detection.
Practitioner guidance
- Create a per-machine credential inventory Enumerate credentials, tokens, and keys present on developer laptops, including local files, caches, shell history, and AI assistant artefacts.
- Segment endpoint-held secrets from centrally managed secrets Classify which credentials are intended to live only on developer workstations and assign explicit owners, rotation expectations, and offboarding triggers for each class.
- Extend incident response to local secret residue Add laptop artefact review to compromise playbooks so responders can determine what credentials were present before they start rotating and revoking access.
What's in the full announcement
GitGuardian's full brief covers the operational detail this post intentionally leaves for the source:
- Early access findings on what attackers actually harvest from developer laptops and which artefacts are most exposed.
- The four metrics used to report fleet exposure, control coverage, and auditor-testable evidence.
- The 95-day post-incident window and why it changes response sequencing for local secret exposure.
- How to begin an endpoint credentials audit using scheduled scans and device management integration.
👉 Read GitGuardian's brief on hidden credential risk in developer workstations →
Developer workstation secrets exposure: what IAM teams need to know?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
14/09/2026 10:11 am
Developer workstations have become a blind spot in NHI governance because they hold credentials that never enter the traditional inventory stack. EDR can detect suspicious activity, and vaults can protect centrally managed secrets, but neither creates a machine-level record of what lives on a developer laptop. The governance problem is therefore not visibility in the abstract, but ownership of a credential-bearing device that security teams still treat as a generic endpoint. Practitioners need to recognise the workstation itself as part of the non-human identity estate.
A few things that frame the scale:
- 91% of former employee tokens remain active after offboarding, leaving organisations vulnerable to potential security breaches, according to The 2025 State of NHIs and Secrets in Cybersecurity.
- 62% of all secrets are duplicated and stored in multiple locations, causing unnecessary redundancy and increasing the risk of accidental exposure.
A question worth separating out:
Q: What is the difference between repository scanning and workstation credential inventory?
A: Repository scanning finds secrets that reach source control. Workstation credential inventory finds secrets that remain on developer devices, including local files, caches, and assistant-generated artefacts, which is the layer attackers often harvest first after a laptop compromise.
👉 Read our full editorial: Developer workstation credential inventory closes a hidden control gap
