Notifications
Clear all
Topic starter
20/08/2026 5:28 pm
TL;DR: Secrets management remains a lifecycle problem, not just a storage problem: Cycode argues that organizations must secure API keys, passwords, tokens, and certificates across creation, storage, rotation, monitoring, and CI/CD injection as secrets sprawl grows across distributed cloud environments. The practical gap is that centralized vaults, scanning, and rotation still fail when credentials persist in code, pipelines, and collaboration tools.
NHIMG editorial — based on content published by Cycode: Secrets Management Best Practices and Guide
By the numbers:
- Organizations face significant risks from secrets sprawl, with 96% reporting secrets scattered across code, configuration files, and multiple environments.
Questions worth separating out
Q: How should security teams handle cloud secrets that are shared across applications and pipelines?
A: Treat shared secrets as a governance defect, not just an operational convenience.
Q: Why do leaked secrets remain dangerous after they are detected?
A: They remain dangerous because discovery does not automatically invalidate authentication.
Q: What breaks when teams rely on long-lived secrets in modern delivery pipelines?
A: Long-lived credentials create standing access that persists across builds, deployments, and troubleshooting sessions.
Practitioner guidance
- Map every secret touchpoint in the delivery chain Catalogue where credentials appear in code, repositories, build logs, collaboration tools, container images, and cloud configuration files.
- Replace persistent pipeline secrets with short-lived workload credentials Use runtime injection, workload identity federation, and session-scoped tokens so CI/CD jobs do not depend on stored long-lived secrets.
- Bind detection to validation and revocation Do not stop at discovery.
What's in the full article
Cycode's full guide covers the operational detail this post intentionally leaves for the source:
- Step-by-step implementation guidance for centralized vaulting, rotation, and monitoring across the SDLC
- Detailed tool selection criteria for secrets scanning, validation, and pipeline integration
- Expanded examples of CI/CD, cloud, and collaboration-tool exposure paths that this post only summarises
- Operational guidance on handling secret remediation, compliance evidence, and platform evaluation
👉 Read Cycode's secrets management best practices guide →
Secrets management at scale: what IAM teams are missing?
Explore further
20/08/2026 6:16 pm
Secrets sprawl is a governance failure, not a storage failure. Central vaults matter, but they do not solve the fact that secrets are copied into code, CI/CD, chat, tickets, and artifacts. That fragmentation breaks the assumption that a secret has one governed home and one revocation path. Practitioners should treat every copy of a secret as part of the identity lifecycle, not as a mere convenience artifact.
A few things that frame the scale:
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation, according to The State of Secrets Sprawl 2026.
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded.
A question worth separating out:
Q: How do IAM and NHI programmes reduce secrets sprawl without slowing delivery?
A: Use workload identity, runtime injection, and environment-based segmentation so credentials are issued only when needed and only where needed. That preserves developer velocity while shrinking the number of places a secret can leak or be reused.
👉 Read our full editorial: Secrets management best practices are still failing at scale
