The Sprawl Secret Age: Millions of Exposed Credentials, IA and New Identity Governance

The phenomenon known as "secrets sprawl" not only continues, but in 2025 it accelerated at a rate that surprised many security teams. A large-scale analysis of public repositories and internal environments reveals that millions of credentials were exposed in code, in collaborative tools and in images and records, expanding an attack surface that was already difficult to contain. The numbers are strong: in 2025 alone tens of millions of new secrets were detected, which confirms that punctual detection is no longer sufficient.

Behind this explosion is a factor that deserves special attention: the massive adoption of artificial intelligence tools and model-assisted workflows. Code assistants and snippets generators have changed both the way they write software and the place where they are stored and shared credentials. IA integrations generate new machine-to-machine identities and multiply leakage points from APIs keys for LLM services to tokens for managed orchestrators and backends. To understand why this is critical, it is enough to see that many of the most growing categories of secrets are related to infrastructure of IA and its APIs.

Another finding that should alter the priorities of any security team is the location of high-value secrets. While the media focus is usually in public GitHub, internal environments contain most of the sensitive credentials: CI / CD tokens, cloud access keys, database passwords and the like. Treating internal repositories as if they were "hidden" is no longer a viable strategy, because in many cases they are precisely the objective that allows to scale a commitment from an initial point to critical resources.

In addition, leaks are not restricted to the source code. A significant part of incidents originate from collaborative tools such as messaging channels, tickets and shared documentation. These spaces are used to solve incidents, for onboarding or for rapid exchange of temporary credentials, and often receive less automated controls than the code. When the keys appear in Slack, Jira or Confluence are often more critical because their exposure is not limited to the history of commitments but is spread between equipment and logos.

The presence of secrets in self-housed infrastructure and containers is another worrying vector. Scanning about self-housed Git records and systems have shown thousands of exposed credentials, with a significant percentage still valid at the time of the finding. Docker's images, in particular, often contain construction artifacts and environment variables that end up being durable copies of keys and tokens. When credentials travel in images or build artifacts, their rotation is complicated and their impact potential is multiplied.

One thing that should sound all the alarms is the durability of the filtered secrets: many credentials confirmed as valid years ago remain exploitable today. This indicates that the revocation and rotation processes are not systematically implemented; in many environments the default option to a rotation that could break production is to do nothing. Detection without a real systematic remediation capacity turns findings into persistent vulnerabilities.

The attacks on the supply chain have offered a particularly revealing window on how the secrets behave on compromised machines. Research that analyzed compromised systems showed that the same credential can appear in multiple places on the same team: .env files, shell history, IDE configurations, caches and build artifacts. And, more alarming, a significant proportion of machines engaged were CI / CD runners, which transformed a local leak into an organizational problem. A key replicated in several artifacts turns a local human error into a high-impact access to scale.

The standardization of agents and protocols that connect models with tools and data is introducing a new class of exposures. As IA systems are integrated with external services through local configurations and flags, it is more common to find secrets in JSON files or in agent configurations. This raises an operational question that many organizations still do not answer on a scale: what non-human identities exist, who manages them and what permits do they possess? Without an inventory and governance of machine-to-machine identities, the adoption of IA risks creating an uncontrollable mesh of access.

The answer is not to return to isolation, but to transform how credentials are managed in the day-to-day development. It is essential to leave static and long-term credentials behind, incorporate ephemeral and short identities, and convert the vault and secret solutions into the default experience for developers. In addition, each service account, each CI Job and each agent must receive a life cycle treatment: creation, ownership, permissions and revocation. Effective security requires moving from detecting leaks to automating mediation and governing non-human identities.

If you are looking for readings and resources to deepen, the GitGuardian pages provide a comprehensive analysis of these phenomena, while platforms such as GitHub document detection and hardening practices for pipelines and actions ( GitHub documentation on secret scanning and hardening of GitHub Actions). To adopt workflows focused on identity and ephemeral credentials, documentation of solutions such as HashiCorp Vault offers practical guides ( HashiCorp Vault), and the frameworks and recommendations on supply chain security and supply chain as SLSA or the resources of CISA help contextualize risks and defensive measures.

In short, the perimeter has changed and with it must change the strategy. The age of only public GitHub scanning and waiting for compliance is no longer enough. Organizations that want to continue to deploy IA and accelerate unexposed development must integrate full visibility - internal repositories, collaborative tools, containers, registrations and developer endpoints - with automated rotation processes and non-human identity governance. Only in this way can the noise of millions of secrets become a sustainable and secure access management.