Notifications
Clear all
Topic starter
08/07/2026 7:06 pm
TL;DR: Secret sprawl is expanding across code, chat, and AI workflows, with leaked credentials now showing up outside repositories and often remaining valid long after exposure, according to GitGuardian and vendor analysis. The right response is not just better storage, but lifecycle control, rotation, scanning, and revocation across human, machine, and agent identities.
NHIMG editorial — based on content published by Infisical: The Best Secrets Management Tools in 2026
By the numbers:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers.
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation.
Questions worth separating out
Q: How should security teams reduce secret sprawl across cloud and AI workflows?
A: Start by treating secrets as governed identities with an owner, scope, lifecycle, and revocation path.
Q: Why do exposed secrets remain such a serious risk after discovery?
A: Because many leaked credentials are still valid when found.
Q: What do teams get wrong about secrets rotation?
A: They often rotate on a schedule without fixing where secrets are copied, shared, and reused.
Practitioner guidance
- Define secret lifecycle ownership Assign a named owner for creation, rotation, revocation, and retirement of every secret class, including API keys, tokens, and certificates.
- Pair scanning with automatic revocation Connect repository, chat, and ticketing scanners to revocation workflows so a confirmed leak triggers credential invalidation, not just an alert.
- Segment credentials by workload and toolchain Issue separate secrets for CI/CD runners, application services, and AI agent workflows so one compromise does not grant broad reuse.
What's in the full article
Infisical's full blog post covers the operational detail this post intentionally leaves for the source:
- Feature-by-feature comparisons of cross-cloud, cloud-specific, open-source, and in-house secrets management approaches
- Tool-specific operational trade-offs for Vault, OpenBao, Doppler, AWS Secrets Manager, GCP Secret Manager, and Azure Key Vault
- Implementation details on secret rotation, access workflows, and developer ergonomics across the listed tools
- Practical selection guidance for teams deciding between self-hosted control and managed convenience
👉 Read Infisical's comparison of the best secrets management tools in 2026 →
Secret sprawl in 2026: what secrets tools are really solving?
Explore further
08/07/2026 7:30 pm
Secret sprawl is now an identity lifecycle failure, not just a storage problem. The article correctly shows that credentials move through code, collaboration tools, CI/CD, and AI workflows before they are ever protected or rotated. Once a secret has multiple replicas, the governance question becomes where its lifecycle is terminated, not where it was originally stored. Practitioners should treat every secret as a governed identity with creation, use, exposure, revocation, and retirement states.
A few things that frame the scale:
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, according to Guide to the Secret Sprawl Challenge.
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded.
A question worth separating out:
Q: How do you know if a secrets management programme is working?
A: Look for lower secret reuse, faster revocation after exposure, and fewer valid secrets found outside approved storage. A working programme also reduces the number of credentials that appear in chat, tickets, logs, and AI-assisted workflows. If exposed secrets remain usable for long periods, the programme is not yet controlling the identity lifecycle.
👉 Read our full editorial: Secrets management tools in 2026 expose the cost of secret sprawl
