Do you know where your secrets are? Exploring the problem of secret sprawl

The talk opens with breaches linked to credentials left in code or environments, including Uber, CircleCI and Toyota, and argues that exposed secrets are a recurring step in attackers moving laterally and escalating privileges. The speaker frames the problem as secret sprawl: credentials copied into source repositories, CI pipelines, logs and storage buckets, often during debugging and rarely removed afterward.

The middle section walks through data from scanning public GitHub commits. Figures cited include roughly 10 million newly detected hardcoded credentials in a single year, a 67 percent rise, and about 5.5 secrets for every thousand commits. Google API keys made up most detections, while OpenAI keys were the fastest-growing category in the current year. A survey of IT decision makers found that most had experienced a leak in the previous 18 months, and many relied only on manual code review to catch them.

The closing part presents a five-level secret management maturity model, from hardcoding credentials at the bottom to dynamic, short-lived secrets with automated rotation and continuous monitoring at the top. It rests on three pillars: people, processes and tools. Practical takeaways include scoping credentials narrowly, moving them into a vault, scanning at commit, pull request and build stages, and treating network egress controls as part of the defense. The speaker encouraged teams to assess their current level and plan the next step.