Top Highlights
- Secrets sprawl is accelerating rapidly, with a 34% increase in 2025 and AI tools driving 81% more leaks, expanding the attack surface.
- Internal repositories and collaboration tools are now primary leak sources, with internal repos being 6x more likely to expose secrets than public ones.
- A significant percentage of leaked secrets (64%) remain valid after years, highlighting gaps in rotation, revocation, and automated credential management.
- The shift to non-human identity governance and comprehensive visibility across systems are crucial to manage evolving secrets risks effectively.
Secrets Sprawl Continues to Accelerate with Technological and Cultural Shifts
Recent findings reveal that the spread of secrets in software development is outpacing the growth of developer communities. Since 2021, leaked secrets have increased by 152%, surpassing the 98% growth in GitHub’s public developer base. This trend is driven by more developers, often aided by AI tools, generating and sharing credentials more frequently. Moreover, leaks linked to AI services surged by 81% in 2025, highlighting the expanding attack surface as AI integrations become standard. Therefore, organizations must recognize that simply detecting leaks is no longer enough; they need proactive strategies to prevent secrets from spreading in the first place.
The Need for Broader, Automated Governance and New Security Paradigms
The report emphasizes that internal repositories are now six times more likely to leak sensitive secrets than public ones, containing critical tokens used for cloud access, CI/CD pipelines, and databases. Additionally, a significant portion of secrets leak outside code, particularly through collaboration tools like Slack and Jira, where over a quarter of leaks originate. Furthermore, self-hosted systems and container registries expose thousands of credentials, many still valid years later, due to a lack of automatic rotation and revocation. As AI-driven supply chain attacks and new frameworks like MCP emerge, industry focus must shift from detection to continuous governance of all identities, human and non-human alike. Moving forward, embedding security into every stage of development and deployment will be essential to curbing this alarming trend.
Discover More Technology Insights
Stay informed on the revolutionary breakthroughs in Quantum Computing research.
Access comprehensive resources on technology by visiting Wikipedia.
DataProtection-V1
