Notifications
Clear all
Topic starter
02/09/2026 1:29 pm
TL;DR: Secrets management platforms reduce exposure, but the article argues that the real challenge is lifecycle governance across creation, distribution, rotation, and revocation in CI/CD, containers, and multi-cloud environments, according to Securden. The security gap is not storage alone but whether secrets are continuously controlled as credentials move through modern development workflows.
NHIMG editorial — based on content published by Securden: Secrets management and the unified identity security approach for modern development
By the numbers:
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation.
Questions worth separating out
Q: How do security teams know whether secrets in CI/CD are actually controlled?
A: Look for three signals: how many secrets a workflow can reach, how long those secrets remain valid, and whether any of them can publish or sign artefacts.
Q: Why do leaked secrets remain dangerous after they are detected?
A: They remain dangerous because discovery does not automatically invalidate authentication.
Q: What do security teams get wrong about secret rotation?
A: They often treat rotation as a substitute for removing the underlying credential model.
Practitioner guidance
- Inventory every secret-bearing path Trace where API keys, tokens, passwords, certificates, and signing material appear across code, CI/CD, chat, ticketing, and production systems.
- Enforce rotation with verified revocation Do not treat rotation as complete until the previous credential is confirmed invalid in every downstream service.
- Use pipeline-specific credentials with narrow scope Issue separate credentials for build jobs, deployment jobs, and runtime services so one compromise does not expose the whole estate.
What's in the full article
Securden's full analysis covers the operational detail this post intentionally leaves for the source:
- Step-by-step secrets lifecycle workflows across creation, rotation, and revocation.
- Integration detail for Jenkins, Ansible, Terraform, Chef, and Puppet.
- Deployment options for self-hosted and managed environments with different control trade-offs.
- Product-specific notes on just-in-time elevation, one-time access, and session recording.
👉 Read Securden's analysis of secrets management for modern development workflows →
Secrets management lifecycle gaps: are your controls keeping up?
Explore further
02/09/2026 1:30 pm
Secrets management is really lifecycle governance for non-human identities. A token, certificate, or API key is only safe if its creation, use, rotation, and retirement are all governed as one process. The article correctly treats vaulting as necessary but not sufficient, because runtime delivery and revocation decide whether the secret remains an identity with active power. Practitioners should treat every secret as a governed credential, not a stored asset.
A few things that frame the scale:
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded, according to The State of Secrets Sprawl 2026.
- Internal repositories are 6x more likely to contain secrets than public ones, with 32.2% versus 5.6%, according to The State of Secrets Sprawl 2026.
A question worth separating out:
Q: Should organisations choose a vault, a cloud secrets manager, or a unified identity platform?
A: Choose based on where your secrets live, how many environments they must reach, and how much lifecycle control you need. Cloud-native managers work well in simpler footprints, while broader identity platforms become more useful when you need policy, audit, privileged access, and secrets governance in one operating model.
👉 Read our full editorial: Secrets management platforms still miss the lifecycle problem
