Topic starter
11/08/2026 3:10 pm
TL;DR: 28.65 million new hardcoded secrets were found in public GitHub commits in 2025, a 34% year-over-year increase, according to SSH Communications Security citing GitGuardian's State of Secrets Sprawl 2026, with AI services driving much of the growth and many leaks remaining valid after exposure. The core issue is governance debt: identity programmes must control creation, ownership, rotation, and revocation of machine credentials, not just detect them.
Editorial analysis by NHI Mgmt Group, based on content published by SSH Communications Security: “Secret Sprawl Isn’t Just a Developer’s Problem—It's a Business Risk”.
Key questions
Q: What breaks when secrets are allowed into AI development workflows?
A: Secrets stop behaving like isolated credentials and start behaving like replicated content.
Q: Why do leaked service credentials remain dangerous after they are discovered?
A: They remain dangerous because exposure and invalidation are separate events.
Q: What happens when secrets and machine identities are left unmanaged in AI and cloud environments?
A: Unmanaged secrets expand the attack surface and make compromise harder to detect.
Practitioner guidance
- Inventory machine identities across AI workflows Create a live inventory of service accounts, API keys, tokens, and workload credentials used by AI services, CI/CD pipelines, and cloud integrations.
- Expand secrets monitoring beyond code repositories Include Slack, Confluence, Jira, and other collaboration platforms in detection and remediation workflows.
- Replace long-lived machine credentials with short-lived issuance Move high-value integrations toward attested workload identities and just-in-time credential issuance so reusable secrets are removed from steady-state operation.
Bottom line: AI-driven development is increasing the number of machine credentials faster than traditional secrets programmes can reliably govern.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/08/2026 3:25 pm
AI development is turning secrets sprawl into an identity governance problem, not just a detection problem. The article's central finding is that machine credential creation is accelerating as teams build faster with AI services, cloud integrations, and ephemeral workflows. That changes the control objective from finding secrets to governing the lifecycle of the identities behind them. Practitioners should treat secrets volume as a symptom of deeper identity sprawl.
A few things that frame the scale:
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded, according to the State of Secrets Sprawl 2026.
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What is the difference between secrets detection and NHI governance?
A: Secrets detection finds exposed credentials, while NHI governance tracks how those credentials are issued, reused, rotated, and retired. Detection answers whether a secret is visible. Governance answers whether the identity behind that secret is controlled throughout its lifecycle. Mature programmes need both because exposure without lifecycle control leaves the same risk open.
👉 Read our full editorial: AI-driven secrets sprawl is outpacing NHI governance controls