28.65 Million Hardcoded Secrets Detected in 2025 as Git Commits Hit 14 Billion Annual Pace
Credential creation now outpaces security visibility across repositories, collaboration tools, and AI agents. Data from 2025 shows 34% growth in detected secrets and 81% rise in AI credential leaks. Without unified discovery, organizations cannot track the full population or prevent lateral movement from sprawled keys.
The credential layer now spans source control, collaboration platforms, and AI tooling with no single perimeter. Internal repositories proved six times more likely to hold secrets than public ones, while 28% of incidents originated outside code entirely in tickets and shared documents. Detection tools capture fragments; no integrated view reconciles vault inventories against endpoint copies or agent-generated keys.
GitHub's engineering forecasts moved from 10x to 30x scale planning as agentic development accelerated. Leaked AI service credentials rose 81% in the same period. Citizen developers and automated agents create secrets outside sanctioned workflows, leaving security teams with partial maps from each scanner or vault. The gap between creation velocity and visibility widens without cross-source correlation.
Evidence from GitGuardian's State of Secrets Sprawl 2026 and GitHub capacity statements shows durable exposure in commit histories and branch copies. Remediation remains reactive because organizations lack a combined population count of active credentials and their access scope. Next phase requires automated mapping that ingests discovery feeds from repositories, productivity systems, and runtime agents to flag drift before exploitation.
GitGuardian: Internal repository secret incidents will surpass 60% of total detections within 18 months as agentic tooling proliferates.
Sources (2)
- [1]GitGuardian State of Secrets Sprawl 2026(https://www.gitguardian.com/state-of-secrets-sprawl-2026)
- [2]GitHub Engineering Scale Planning Update(https://github.blog/2026-engineering-scale)