Secrets Sprawl - Key Takeaways for CISOs in 2026
Basically, secret credentials are leaking faster than ever, especially with AI tools involved.
Secrets sprawl has surged, with 29 million new hardcoded secrets found in 2025. Security teams must adapt to protect against rising risks. GitGuardian's report reveals critical insights for managing credentials effectively.
What Happened
In 2025, secrets sprawl accelerated dramatically, with GitGuardian's report revealing 29 million new hardcoded secrets discovered across public GitHub. This marked a 34% increase from the previous year, the largest single-year jump ever recorded. The report identified three core trends: AI's impact on credential leaks, the exposure of internal systems, and ongoing challenges in remediation. As organizations increasingly rely on AI and developer tools, the risk associated with secrets sprawl continues to grow.
Who's Affected
The findings indicate that security teams across various sectors are at risk, as secrets are leaking at unprecedented rates. Internal repositories are particularly vulnerable, with 32.2% containing at least one hardcoded secret, compared to only 5.6% in public repositories. This discrepancy highlights a critical oversight in security practices. Additionally, 28% of leaks originated from collaboration tools like Slack and Jira, emphasizing the need for comprehensive monitoring across all platforms where credentials are shared.
What Data Was Exposed
The report shows that AI services alone drove an 81% increase in leaked secrets, with over 1.2 million secrets tied to these services in 2025. Notably, self-hosted GitLab and Docker registries exposed secrets at rates 3-4 times higher than public GitHub. Furthermore, 64% of secrets leaked in 2022 remained valid today, illustrating a significant gap in remediation efforts. This data underscores the critical nature of the credentials being leaked, which often include CI/CD tokens and cloud access credentials that attackers target.
What You Should Do
Organizations must shift their approach to managing secrets. This includes moving beyond mere detection to implementing non-human identity governance. Security teams should adopt strategies that eliminate long-lived static credentials, favoring short-lived identity-driven access. Regularly scanning internal systems, collaboration tools, and developer endpoints for leaks is essential. Additionally, teams should develop remediation workflows that allow for secure credential rotation without disrupting production environments. The evolving landscape of secrets sprawl necessitates a proactive and comprehensive security strategy.