Topic starter
30/10/2025 3:30 pm
TL;DR: GitGuardian's 2025 secrets sprawl analysis says hardcoded credentials continue to spread faster than organisations can revoke them, with leaked secrets still lingering after detection and outside the control of central secrets managers. The real governance problem is not discovery alone but whether credential lifecycle controls can contain exposure before reuse.
Editorial analysis by NHI Mgmt Group, based on content published by GitGuardian: “SECRETS SPRAWL”.
Key questions
Q: What breaks when a leaked secret is revoked without context?
A: Uncontextualised revocation can break live integrations, payment paths, or other production dependencies while failing to reduce exposure in a controlled way.
Q: Why do leaked API keys and tokens create such a large security risk?
A: They authenticate actions directly, so anyone who finds them can act as a trusted caller.
Q: How can security teams tell whether secret management is actually working?
A: Look for fewer plaintext secrets, narrower reuse, faster rotation, and a shrinking set of credentials that remain valid across multiple systems.
Practitioner guidance
- Map every secret to an accountable owner Require each API key, token, certificate, and service secret to have a named owner, a system of record, and a defined revocation path before it reaches production.
- Automate revocation after secret detection Connect scanning tools to revocation workflows so a detected leak triggers invalidation, rotation, and downstream access checks instead of a manual ticket queue.
- Expand scanning beyond source control Include Slack, Jira, Confluence, CI/CD variables, build logs, and package artefacts in the secret discovery scope because the leak surface now extends past repositories.
Bottom line: Secrets sprawl now exposes a basic governance gap: organisations can discover leaks faster than they can confidently revoke the credentials behind them.
What's in the full report
GitGuardian's full report covers the operational detail this post intentionally leaves for the source:
- Year-over-year leak patterns by secret type, including the fastest-growing AI-related exposures
- Industry-level leak concentration data that can help security leaders benchmark where secrets are most likely to surface
- The zombie leak analysis showing how long secrets remain valid after discovery
- AI-detection methodology and the generic secret scoring work behind the report's findings
👉 Read GitGuardian's 2025 analysis of secrets sprawl and revocation lag →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 11 months ago by Abdelrahman
This topic was modified 5 days ago by NHI Mgmt Group
07/10/2026 6:21 pm
Secrets sprawl is now a credential lifecycle failure, not just a detection problem. The article shows that organisations can find exposed secrets while still failing to invalidate them fast enough to matter. That means the real control boundary is issuance, propagation, and revocation, not the scanner alone. The practitioner conclusion is blunt: if revocation is slower than exposure, governance has already lost the race.
A few things that frame the scale:
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded, according to the State of Secrets Sprawl 2026.
- 8 of the top 10 fastest-growing types of leaked secrets year-over-year are tied directly to AI services, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Should organisations prioritise secret rotation or secret discovery first?
A: They should do both, but rotation is the control that reduces immediate exposure when a secret is already live. Discovery tells you where the problem is. Rotation and revocation tell you whether the credential still works. If you can only choose one urgent action after a leak, invalidate the credential and confirm it is no longer active.
👉 Read our full editorial: Secrets sprawl is still outpacing enterprise credential revocation