Notifications
Clear all
Topic starter
11/08/2026 3:10 pm
TL;DR: GitGuardian's State of Secrets Sprawl 2026 reports 28.65 million new hardcoded secrets in public GitHub commits in 2025, a 34% year-over-year increase, while 64% of leaked secrets from 2022 still remain valid and exploitable today. The security problem is no longer discovery alone, because identity governance has to keep pace with machine credential creation, ownership, rotation, and revocation across AI and cloud workflows.
NHIMG editorial — based on content published by SSH Communications Security: AI-driven secrets sprawl and the governance shift toward identity-based authentication
By the numbers:
- Internal repositories are 6x more likely to contain secrets than public ones (32.2% vs 5.6%), contradicting the assumption that private repos are safe.
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation.
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers.
Questions worth separating out
Q: How should security teams handle leaked secrets once they are found?
A: They should treat detection as the start of response, not the end.
Q: Why do private repositories still create secret exposure risk?
A: Private repositories still create risk because source files often contain reusable credentials, tokens, build artefacts, and internal package references.
Q: What do teams get wrong about secrets scanning at scale?
A: They treat scanning as the control instead of one input to lifecycle governance.
Practitioner guidance
- Inventory machine credential locations across all development surfaces Build a single view of secrets in source control, CI/CD, collaboration tools, and cloud configuration so the team can see where machine credentials actually live.
- Measure revocation latency as a core security metric Track the time between secret exposure and revocation, then report it alongside detection coverage so stale credentials are treated as an active risk rather than a housekeeping issue.
- Replace embedded secrets with workload identity where possible Prioritise systems that can use attested workload identity and short-lived credentials instead of long-lived shared secrets, especially in pipelines and AI infrastructure.
What's in the full article
SSH Communications Security's full article covers the operational detail this post intentionally leaves for the source:
- How the report breaks down secrets exposure by environment type, including public code, internal repositories, and collaboration tools.
- The detailed reasoning behind identity-based authentication and why static secrets no longer scale in AI-heavy delivery pipelines.
- Practical discussion of SPIFFE and SPIRE as workload identity building blocks for replacing embedded credentials.
- The vendor's own framing of how NHI governance changes when AI-assisted development expands the machine identity surface.
👉 Read SSH Communications Security's analysis of AI-driven secrets sprawl and NHI governance →
Secrets sprawl in AI development: are IAM controls keeping up?
Explore further
11/08/2026 3:25 pm
AI-assisted development is creating identity sprawl faster than secrets governance can absorb. The article's numbers show that the problem is not a single leak class but a rapidly expanding credential surface tied to AI services, orchestration layers, vector databases, and retrieval systems. That changes NHI governance from a repository hygiene problem into an enterprise identity inventory problem. Practitioners should stop treating machine credentials as incidental artefacts and start treating them as governed identities.
A few things that frame the scale:
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, according to The State of Secrets Sprawl 2026.
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase, showing the exposure problem is accelerating rather than stabilising.
A question worth separating out:
Q: How do organisations move from secrets management to identity-based authentication?
A: They replace embedded long-lived credentials with cryptographically verifiable workload identities that can obtain short-lived access on demand. That approach reduces dependence on static secrets, but it also requires tighter lifecycle governance for machine identities, including issuance, attestation, rotation, and retirement.
👉 Read our full editorial: AI-driven secrets sprawl is outpacing NHI governance controls
