Topic starter
23/03/2026 3:40 pm
TL;DR: GitGuardian reports that 28.65 million new hardcoded secrets were added to public GitHub commits in 2025, a 34% year-over-year increase, while AI service secrets reached 1,275,105 and the fastest-growing leaked-secret types were heavily tied to AI services. The governance failure is not discovery speed but ownership, lifecycle control, and remediation keeping pace with software creation.
Editorial analysis by NHI Mgmt Group, based on content published by GitGuardian: “The State of Secrets Sprawl 2026: AI-Service Leaks Surge 81% and 29M Secrets Hit Public GitHub”.
By the numbers:
- Public GitHub commits climbed to about 1.94 billion in 2025, up 43% year over year.
Key questions
Q: What breaks when AI-assisted development outpaces secret governance?
A: When development speed outruns ownership, secrets stop behaving like controlled credentials and start behaving like unmanaged access residue.
Q: Why do leaked secrets remain such a persistent NHI risk?
A: Leaked secrets persist because they are often embedded in code, pipelines, or collaboration tools, then left valid long enough for reuse.
Q: What are the warning signs that secrets sprawl is becoming a control failure?
A: Watch for credentials appearing outside source control, especially in collaboration tools, MCP-related configuration files, local developer environments, and CI/CD runners.
Practitioner guidance
- Map secret-bearing surfaces across the development lifecycle Inventory where credentials appear in repositories, CI/CD, collaboration tools, local workstations, and AI-related configuration files before you tune remediation priorities.
- Assign accountable owners to every non-human credential Tie each secret to a business or technical owner, a rotation expectation, and a revocation path so no exposed credential survives as an orphaned access path.
- Audit AI setup paths for hardcoded credential patterns Review quickstarts, templates, and onboarding documents for API keys, tokens, command-line arguments, and embedded connection strings that normalize unsafe handling.
Bottom line: AI-assisted development is widening the gap between credential creation and credential control, which makes secrets sprawl a programme-level issue.
What's in the full report
GitGuardian's full report covers the operational detail this post intentionally leaves for the source:
- Breakdowns of leaked secrets by environment, including public GitHub, internal repositories, collaboration tools, and developer workstations
- Evidence on how AI service secrets and MCP-related configuration leaks are changing the composition of exposed credentials
- Validation data showing how long previously exposed secrets remain active and exploitable over time
- Examples of the setup and workflow patterns that normalize hardcoded credentials in AI development stacks
👉 Read GitGuardian's analysis of how AI-assisted coding is accelerating secrets sprawl →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
07/10/2026 6:00 pm
AI-assisted coding has turned secrets sprawl into a governance scaling problem. The central change is not just more code, but more identities, more integrations, and more places where credentials can be introduced faster than they can be owned. That means the control failure is no longer isolated leakage, it is programme-level inability to keep pace with creation. Practitioners should read this as an identity lifecycle issue, not a developer hygiene issue.
A few things that frame the scale:
- 8 of the top 10 fastest-growing types of leaked secrets year-over-year are tied directly to AI services, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Should teams prioritise secret discovery or secret lifecycle governance first?
A: Discovery is necessary, but lifecycle governance should be treated as the primary control objective when exposed secrets remain valid. If ownership, rotation, and revocation are not defined, scanning only creates a backlog of unresolved access paths. The better question is whether your remediation process can outpace how fast secrets are created.
👉 Read our full editorial: AI-assisted coding is accelerating secrets sprawl and NHI risk