70% of leaked secrets remain active two years later

Long-lived plaintext credentials have been involved in most breaches over the last several years, according to GitGuardian.

When valid credentials, such as API keys, passwords, and authentication tokens, leak, attackers at any skill level can gain initial access or perform rapid lateral movement through systems.

The 2025 State of Secrets Sprawl report reveals a widespread and persistent security crisis that threatens organizations of all sizes. The report exposes a 25% increase in leaked secrets year-over-year, with 23.8 million new credentials detected on public GitHub in 2024 alone.

The rising threat of leaked secrets

Most concerning for enterprise security leaders: 70% of secrets leaked in 2022 remain active today, creating an expanding attack surface that grows more dangerous with each passing day.

“The explosion of leaked secrets represents one of the most significant yet underestimated threats in cybersecurity,” said Eric Fourrier, CEO of GitGuardian. “Unlike sophisticated zero-day exploits, attackers don’t need advanced skills to exploit these vulnerabilities—just one exposed credential can provide unrestricted access to critical systems and sensitive data.”

Eric Fourrier points to the 2024 U.S. Treasury Department breach as a warning: “A single leaked API key from BeyondTrust allowed attackers to infiltrate government systems. This wasn’t a sophisticated attack—it was a simple case of an exposed credential that bypassed millions in security investments.”

Despite GitHub’s Push Protection helping developers detect known secret patterns, generic secrets—including hardcoded passwords, database credentials, and custom authentication tokens—now represent more than half of all detected leaks. These credentials lack standardized patterns, making them nearly impossible to detect with conventional tools.

A full 35% of all private repositories scanned contained at least one plaintext secret, shattering the common assumption that private repositories are secure.

AWS IAM keys appeared in plaintext in 8.17% of private repositories—over 5× more frequently than in public ones (1.45%). Generic passwords appeared nearly 3× more often in private repositories (24.1%) compared to public ones (8.94%). MongoDB credentials were the most frequently leaked secret type in public repositories (18.84%).

“Leaked secrets in private code repositories must be treated as compromised,” emphasized Eric Fourrier. “Security teams must recognize that secrets should be treated as sensitive data regardless of where they reside.”

Hardcoded secrets are everywhere

Hardcoded secrets are everywhere, but especially in security blind spots like collaboration platforms and containers environments where security controls are typically weaker:

• Slack: 2.4% of channels within analyzed workspaces contained leaked secrets
• Jira: 6.1% of tickets exposed credentials, making it the most vulnerable collaboration tool
• DockerHub: 98% of detected secrets were embedded exclusively in image layers, with over 7,000 valid AWS keys currently exposed

Non-human identities (NHIs)—including API keys, service accounts, and automation tokens—now vastly outnumber human identities in most organizations. However, these credentials often lack proper lifecycle management and rotation, creating persistent vulnerabilities.

A security leader at a Fortune 500 company acknowledged this challenge: “We aim to rotate secrets annually, but enforcement is difficult across our environment. Some credentials have remained unchanged for years.”

Secrets management solutions fall short

Even organizations using secrets management solutions remain vulnerable. A study of 2,584 repositories leveraging secrets managers revealed a 5.1% secret leakage rate —far from the near-zero we anticipate. This surpasses the overall GitHub average of 4.6%.

Common issues include:

• Secrets extracted from secrets managers and hardcoded elsewhere
• Insecure authentication to secrets managers exposing access credentials
• Fragmented governance due to secrets sprawl across multiple secrets managers

As AI-generated code, automation, and cloud-native development accelerate, the report forecasts that secrets sprawl will only intensify. While GitHub’s Push Protection has reduced some leaks, it leaves significant gaps—particularly with generic secrets, private repositories, and collaboration tools.

“For CISOs and security leaders, the goal isn’t just detection—it’s the remediation of these vulnerabilities before they’re exploited,” said Eric Fourrier. “This requires a comprehensive approach that includes automated discovery, detection, remediation, and stronger secrets governance across all enterprise platforms.”

Secret leaks rarely remain isolated incidents. Instead, they typically serve as entry points for sophisticated attack chains that can compromise entire organizations and their supply chains. This reality demands a shift from simple secret detection to comprehensive secret lifecycle management and rapid incident response capabilities.