Topic starter
20/08/2026 5:28 pm
TL;DR: Secrets management remains a lifecycle problem, not just a storage problem: Cycode argues that organizations must secure API keys, passwords, tokens, and certificates across creation, storage, rotation, monitoring, and CI/CD injection as secrets sprawl grows across distributed cloud environments. The practical gap is that centralized vaults, scanning, and rotation still fail when credentials persist in code, pipelines, and collaboration tools.
Editorial analysis by NHI Mgmt Group, based on content published by Cycode: “Secrets Management Best Practices and Guide”.
By the numbers:
- Organizations face significant risks from secrets sprawl, with 96% reporting secrets scattered across code, configuration files, and multiple environments, making tracking and securing credentials increasingly difficult.
Key questions
Q: What breaks when secrets are still stored outside managed vaults?
A: Secrets become easy to reuse across humans, scripts, and agents without a consistent audit trail.
Q: When does secrets sprawl become a business risk rather than an IT hygiene issue?
A: It becomes a business risk when leaked or overused credentials can reach customer data, production systems, or regulated environments before they are revoked.
Q: How can organisations tell whether secrets management is actually working?
A: Look for reduced secret sprawl, faster revocation, and fewer unmanaged copies outside the central system.
Practitioner guidance
- Centralise credential inventory across all environments Map API keys, passwords, tokens, and certificates to a single inventory so you can see where secrets exist across code, pipelines, cloud services, and collaboration tools.
- Replace hardcoded secrets with runtime injection Stop storing credentials in repositories or pipeline definitions and fetch them at execution time from a governed secrets manager with short-lived access.
- Automate rotation on a defined schedule Set rotation policies for high-value credentials so old values are retired routinely instead of surviving until a manual cleanup event.
Bottom line: Secrets management fails when credentials are allowed to proliferate across code, pipelines, and collaboration tools faster than teams can govern their lifecycle.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:16 pm
Secrets sprawl is a lifecycle failure, not a vault failure: the core problem is that credentials are created in one place, copied into many others, and left alive long after their original purpose ends. Central storage helps, but it does not govern all the replicas that appear in code, logs, pipelines, and collaboration tools. The practitioner takeaway is that exposure control has to follow the secret through its full lifecycle.
A few things that frame the scale:
- 54% of organisations are dissatisfied with their current secrets management solution because not all secrets are secured, and 43% cite lack of central management, according to the 2024 State of Secrets Management Survey.
A question worth separating out:
Q: What is the difference between static secret storage and dynamic secret injection?
A: Static storage keeps credentials available for reuse until someone rotates them, while dynamic injection issues credentials only when a workflow runs and discards them after use. The practical difference is persistence: dynamic injection reduces the lifetime of each credential and therefore shrinks exposure.
👉 Read our full editorial: Secrets management best practices are still failing at scale