AI Frenzy Fuels Credential Chaos - Secrets Sprawl Explained
Basically, AI tools are making it easier to share passwords, leading to more leaks.
A massive surge in hardcoded secrets has been reported, with 28.65 million new credentials exposed in 2025. Both public and internal repositories are affected, increasing risks. Organizations must enhance their governance and monitoring to safeguard sensitive data effectively.
What Happened
In a startling revelation, GitGuardian's State of Secrets Sprawl 2026 report has highlighted a dramatic rise in the number of hardcoded secrets found in public GitHub commits. In 2025 alone, 28.65 million new secrets were identified, marking a continuation of a multi-year trend of increasing exposure of sensitive access keys, tokens, and passwords. This issue is no longer confined to public repositories; internal environments have become significant contributors to the problem.
The report indicates that internal repositories are now more likely to contain hardcoded secrets, often linked directly to production systems. This shift poses a severe risk as these secrets are closer to core infrastructure, making them more valuable to potential attackers. Moreover, collaboration tools like Slack, Jira, and Confluence are also part of the issue, as credentials shared during routine operations can inadvertently expose systems to threats.
Who's Affected
The implications of this secrets sprawl are widespread, affecting organizations that rely on both public and internal repositories for their development workflows. The growing use of AI tools in software development has further complicated the landscape, as each new service or API connection adds additional credentials to manage. This complexity increases the risk of exposure, as teams struggle to keep track of all the credentials in circulation.
Organizations utilizing self-hosted infrastructure, such as GitLab instances and Docker registries, are particularly vulnerable. These systems often operate outside standard security scanning processes, leading to a buildup of sensitive data that can remain accessible long after it has been exposed. The report underscores the urgent need for better governance and management of credentials across all environments.
What Data Was Exposed
The types of data at risk include various hardcoded secrets such as access tokens, API keys, and passwords that are embedded within code, configuration files, and infrastructure. Many of these credentials remain valid for years after their initial exposure, creating a long-term security risk. The challenge lies in the complexity of replacing these credentials, which often requires extensive changes across multiple systems, including codebases and deployment pipelines.
Furthermore, the report reveals that some sensitive credentials do not conform to known patterns, making them difficult to identify and validate automatically. This gap in security measures leaves organizations vulnerable to attacks, as attackers can exploit these hidden access points.
What You Should Do
To mitigate the risks associated with credential sprawl, organizations must prioritize the management and monitoring of their secrets. Implementing robust governance frameworks is essential to ensure that all credentials are tracked, validated, and regularly rotated. Teams should adopt automated tools that can scan for hardcoded secrets across both public and internal repositories.
Additionally, fostering a culture of security awareness among developers is crucial. Training sessions on best practices for credential management and the risks associated with hardcoded secrets can empower teams to take proactive measures. As the landscape continues to evolve with the integration of AI tools, staying vigilant and adapting security strategies will be key to protecting sensitive data from exposure.
Help Net Security