A stale secret is a referenced credential whose associated workflows have not run for an extended period, often 90 days or more. It usually indicates a retired or dormant pipeline. Stale secrets deserve immediate review because they can linger unnoticed long after the business process that used them has changed.
Expanded Definition
A stale secret is not just an old credential. It is a secret that still exists in systems, repositories, or runtime paths after the workflow that depends on it has effectively stopped being used. In NHI governance, that usually means the secret has outlived its business purpose and no longer has a clear owner, rotation trigger, or retirement event. That distinction matters because stale secrets often remain technically valid even when the associated pipeline, job, or integration is dormant.
Industry usage is still evolving, but the practical boundary is clear: a stale secret is different from an expired secret, a revoked secret, or a rotated secret that has been replaced cleanly. Teams often discover it during access reviews, incident response, or repository scanning, not through normal operations. The control concern aligns closely with the OWASP Non-Human Identity Top 10 because unused credentials can still be harvested and abused if they remain reachable.
The most common misapplication is treating a dormant pipeline as harmless while its secret still has live permissions and a valid authentication path.
Examples and Use Cases
Implementing stale secret detection rigorously often introduces operational friction, because teams must balance cleanup speed against the risk of breaking low-frequency automation that still matters to production or compliance workflows.
- A CI/CD job was decommissioned after a platform migration, but its API key still sits in a build config and is never rotated or revoked.
- A service account used for monthly billing exports has not run in 120 days, yet the credential remains valid in a vault and can still authenticate if rediscovered.
- A legacy GitHub Action secret is preserved in a repository after the automation was replaced, creating exposure similar to the cases described in the Reviewdog GitHub Action supply chain attack.
- An integration token for a third-party partner remains in a secret manager even after the contract ends, leaving an unnecessary external access path in place.
- Security teams use the Guide to the Secret Sprawl Challenge to identify credentials that have outlived their operational purpose.
Stale-secret handling also maps to guidance in the OWASP Non-Human Identity Top 10, where unused or poorly governed machine credentials are treated as a durable attack surface.
Why It Matters in NHI Security
Stale secrets matter because non-human identities are often numerous, under-documented, and lightly reviewed compared with human accounts. A credential that should have died with an old workflow can become a quiet persistence mechanism for attackers, especially when it retains broad permissions or bypasses modern identity controls. In practice, stale secrets are one of the clearest signs that lifecycle management has broken down.
NHIMG research shows the scale of that breakdown: 71% of NHIs are not rotated within recommended time frames, and 79% of organisations have experienced secrets leaks, with 77% of those incidents causing tangible damage. That combination makes stale secret discovery a governance issue, not just a hygiene task. It also explains why the broader NHI lifecycle guidance in Ultimate Guide to NHIs is so focused on visibility, rotation, and offboarding.
Organisations typically encounter the impact only after a breach investigation or audit reveals that an obsolete credential was still valid, at which point stale secret cleanup becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Unused or lingering machine secrets are a core NHI secret-management risk. |
| NIST CSF 2.0 | PR.AC-1 | Access and credential governance require removal of obsolete authenticators. |
| NIST Zero Trust (SP 800-207) | SC-3 | Zero Trust depends on minimizing credential persistence and unnecessary trust. |
| NIST SP 800-63 | Digital identity guidance emphasizes lifecycle control over authenticators. | |
| CSA MAESTRO | Agentic systems rely on tightly governed tool credentials and secret lifecycles. |
Treat stale secrets as obsolete authenticators and revoke them through a defined lifecycle process.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 26, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
