Unused Secret

Expanded Definition

An unused secret is not merely a forgotten value; it is valid trust material that remains in circulation after the workload, integration, or operational purpose has ended. In NHI governance, the key issue is lifecycle state, not file location. A secret can be unused because a service was retired, a pipeline was replaced, an API integration was abandoned, or a temporary test credential was never revoked. The distinction matters because an unused secret may still authenticate successfully, which makes it materially different from an expired or revoked credential. Industry usage is still evolving, but guidance from the OWASP Non-Human Identity Top 10 and NHI lifecycle practices treats this as an offboarding and secret hygiene failure, not just a housekeeping issue.

Unused secrets often sit outside normal owner awareness, especially when teams inherit old CI/CD variables, application config files, or vault entries that were never tied to a retirement process. The most common misapplication is assuming a credential is harmless because no current team member is actively using it, when the condition that matters is whether the secret still authenticates.

Examples and Use Cases

Implementing unused-secret cleanup rigorously often introduces operational friction, requiring organisations to weigh faster delivery against the risk of breaking hidden dependencies.

• A legacy microservice is decommissioned, but its API key remains in a secrets manager and still grants access to a partner endpoint.
• A CI/CD token created for a one-time migration is left in a pipeline variable and later becomes a reusable entry point for attackers. The pattern is documented in NHIMG research on the CI/CD pipeline exploitation case study.
• A developer rotates application code, but an old certificate remains valid in a test environment and is later copied into production tooling.
• An abandoned cloud integration still holds permissions to storage or messaging services, creating dormant access that no ticketing process ever removed. Similar exposure patterns appear in the Guide to the Secret Sprawl Challenge.
• A third-party webhook secret is never revoked after a vendor relationship ends, leaving an authenticated path open long after the business need has disappeared.

These cases are often identified during audits, incident response, or after a repository scan reveals stale credentials, and they should be handled with the same urgency as active secret exposure.

Why It Matters in NHI Security

Unused secrets are dangerous because they preserve access without preserving accountability. Once a workload is retired, the credential often loses its operational owner, yet it can still be used by an attacker, a former contractor, or a compromised automation path. NHIMG data shows that 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, which underscores how stale credentials become an active breach factor rather than a theoretical one. This is why NHI security programs treat unused-secret detection as part of offboarding, rotation, and continuous inventory management, not as an isolated cleanup task.

Unused secrets also weaken Zero Trust assumptions because a credential that should have died can still satisfy authentication and authorisation checks. That creates invisible trust debt across cloud apps, pipelines, and SaaS integrations, especially where secret sprawl has already made ownership unclear. The problem is reinforced by the same patterns described in NHIMG analysis of 52 NHI Breaches Analysis and by broader identity governance guidance in the OWASP NHI guidance. Organisations typically encounter the consequence only after a repo leak, a supply chain incident, or an unexpected access event, at which point the unused secret becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Idle Secret
• What is the difference between an identity, a credential, and a secret?
• Why is proactive secret scanning important for NHI security?
• What is the difference between privilege reduction and secret rotation?