DevSecOps in Practice

The Fast-Growing Problem of Secrets Sprawl

The exposure of secrets in public repositories has become an alarming issue, with 12.8 million secrets leaked on GitHub in 2023 alone, representing a 28% increase from the previous year, according to GitGuardian’s 2024 Secrets Sprawl Report. The number of unique secrets detected reached 3.7 million, highlighting a 25% rise, and the problem has quadrupled in just four years. This rapid expansion of secrets sprawl is largely driven by the increasing complexity of digital supply chains and the lack of stringent security measures among developers.

Leaked credentials have become a major attack vector, with nearly half of breaches by external actors involving stolen credentials, according to Verizon’s 2023 Data Breach Report. Sophos’ 2023 Active Adversary Report revealed that in the first half of the year, compromised credentials were the leading root cause of security incidents, surpassing vulnerabilities. An analysis of public repositories found that one in ten commit authors had leaked a secret, and seven out of every thousand commits contained an exposed credential, further emphasizing the scale of the issue.