Hardcoded Secrets Are the Credentials You Forgot About, and They Still Work

Somewhere in your systems there is a database password, an API key, or an access token you have completely forgotten exists. It was committed to a repo two years ago, pasted into a config once, or dropped into a chat thread to unblock a teammate. Nobody rotated it. Nobody revoked it. And it still works perfectly.

That is the real shape of the secrets problem. It is less about one dramatic breach and more about credentials quietly piling up across your stack, staying valid long after anyone remembers them, waiting for someone to find them.

GitGuardian scans public GitHub commits every day looking for exposed credentials. Their State of Secrets Sprawl 2026 report found about 28.65 million new hardcoded secrets pushed to public repositories in 2025. That is a 34 percent jump over the year before, and the biggest single-year increase they have ever recorded.

The important word there is sprawl. Secrets do not stay in one tidy place. GitGuardian found that 28 percent of exposures in 2025 happened entirely outside source code — in tools like Slack, Jira, and Confluence. A credential gets pasted into a ticket to unblock a colleague, and now it lives in a system nobody treats as sensitive. Multiply that across a team over a few years and you get a map nobody actually has.

AI-assisted development adds to the pile. Models tend to reproduce the patterns in their training data, where secrets often appear inline as examples, so generated snippets can drop a real-looking key straight into the source. GitGuardian counted over 1.27 million exposed AI-service credentials in 2025, up 81 percent from the year before.

A hardcoded secret is not a minor hygiene issue. It is often the whole attack. Verizon's 2025 Data Breach Investigations Report found that stolen credentials were the single most common way attackers gained their initial foothold, involved in 22 percent of breaches. Narrow it to attacks on basic web applications and 88 percent of them involved stolen credentials.

A leaked key does not need an exploit chain or a clever trick. It just works — the same way a valid login works. That is exactly what makes it so valuable to an attacker and so easy to miss on your side.

Here is the detail most people underestimate. A secret does not stop being dangerous the moment you notice it. GitGuardian found that 64 percent of the valid secrets leaked back in 2022 are still valid and exploitable today. Years later. Nobody rotated them.

Attackers do not need to be fast. They need you to be slow. A key that leaks today and sits unrevoked for two years is a two-year open door into your systems. And because these credentials belong to machines and services rather than people, nobody is watching a login screen or getting a suspicious-sign-in email. The access just quietly works.

A common assumption is that this only matters for public code. The data says otherwise. GitGuardian found that around 32 percent of internal repositories contain at least one hardcoded secret, roughly six times the rate in public repos. Secrets found in self-hosted GitLab and Docker setups were three to four times more likely to be live, working credentials.

You do not fix secrets sprawl by asking developers to "be more careful." People are busy, deadlines are real, and AI tooling is generating more code than any human can manually audit. The only thing that scales is making the secure path the easy path.

A solid secrets management setup means: a real secrets manager like HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault holding your credentials, so the code references a secret instead of containing it. Auto-rotation on keys and tokens, so a credential that does leak is stale before anyone can weaponize it. CI/CD integration that injects secrets at runtime, so nothing sensitive ever needs to live in the repo. Pipeline scanning with tools like GitLeaks or TruffleHog that block a leaked secret before it merges. And a full history scan, because the dangerous key is often something committed months ago that everyone forgot about.

Detection is not the same as fixing it. Scanning finds a secret but does not disable it. Until the credential is revoked and replaced, it remains an active identity an attacker can use. A durable fix combines detection with a real vault, automatic rotation, and CI/CD injection so secrets never live in the code.