The Good Tech Companies - GitGuardian Report: 70% Of Leaked Secrets Remain Active For Two Years, Urging Immediate Remediation

Episode Date: March 11, 2025

This story was originally published on HackerNoon at: https://hackernoon.com/gitguardian-report-70percent-of-leaked-secrets-remain-active-for-two-years-urging-immediate-remediation. The report exposes a 25% increase in leaked secrets year-over-year, with 23.8 million new credentials detected on public GitHub in 2024 alone. Check more stories related to cybersecurity at: https://hackernoon.com/c/cybersecurity. You can also check exclusive content about #cybersecurity, #gitguardian, #cybernewswire, #press-release, #gitguardian-announcement, #cyber-security-awareness, #cyber-threats, #good-company, and more. This story was written by: @cybernewswire. Learn more about this writer by checking @cybernewswire's about page, and for more stories, please visit hackernoon.com. GitGuardian's State of Secrets Sprawl Report reveals 25% increase in leaked secrets year-over-year. 70% of secrets leaked in 2022 remain active today, creating an expanding attack surface. 35% of all private repositories scanned contained at least one plaintext secret.

This audio is presented by Hacker Noon, where anyone can learn anything about any technology. GitGuardian report 70% of leaked secrets remain active for two years, urging immediate remediation, by CyberNewsWire. Boston, USA, March 11, 2025, CyberNewsWire, asterisk GitGuardian, the security leader behind GitHub's most installed application, today released its comprehensive, 2025 State of Secrets sprawl report, revealing a widespread and persistent security crisis that threatens organizations of all sizes. The report exposes a 25% increase in leaked secrets year over year, with 23.8 million

new credentials detected on public GitHub in 2024 alone. Most concerning for enterprise security leaders, 70% of secrets leaked in 2022 remain active today, creating an expanding attack surface that grows more dangerous with each passing day. Greater than, the explosion of leaked secrets represents one of the most significant yet greater than underestimated threats in cybersecurity," said Eric Ferrier, CEO of Greater Than Git Guardian. Unlike sophisticated zero-day exploits, attackers don't need greater than advanced skills to exploit these vulnerabilities. Just one exposed credential greater than can provide unrestricted access to critical systems and sensitive data. Eric Ferrier points to the

2024 U.S. Treasury Department breach as a warning. A greater than single leaked API key from BeyondTrust allowed attackers to infiltrate greater than government systems. This wasn't a sophisticated attack. It was a simple case of greater than an exposed credential that bypassed millions in security investments. Key findings for security leaders The report identifies several critical trends that demand immediate attention.

The blind spot. Generic secrets despite GitHub's push protection helping developers detect known secret patterns, generic secrets, including hard-coded passwords, database credentials, and custom authentication tokens, now represent more than half of all detected leaks. These credentials lack standardized patterns, making them nearly impossible to detect with conventional tools. Private Repositorees. A false sense of security the analysis reveals a startling truth. A full 35% of all private repositories scanned contained at least one plaintext secret, shattering the common assumption that private repositories are secure. AUS-IAM keys appeared in plaintext in 8.17% of private repositories, over 5 times more frequently than in public ones, 1.45% generic passwords appeared nearly 3 times more often in private repositories, 24.1% compared to public ones, 8.94% MongoDB credentials were the most frequently leaked

secret type in public repositories, 18.84% greater than leaked secrets in private code repositories must be treated as compromised, greater than emphasized Eric Ferrier. Security teams must recognize that secrets should greater than be treated as sensitive data regardless of where they reside. Beyond code. Secrets sprawl across the SDLC hard-coded secrets are everywhere, but especially in security blind spots like collaboration platforms and containers environments where security controls are edipically weaker. Slack. 2.

4% of channels within analyzed workspaces contained leaked secrets. Jira 6. 1% of tickets exposed credentials, making it the most vulnerable collaboration tool. Docker Hub 98% of detected secrets were embedded exclusively in image layers, with over 7,000 valid AWS keys currently exposed. The non-human identity crisis non-human identities, NHIs, including API keys, service accounts, and automation tokens, now vastly outnumber human identities in most organizations. However, these credentials often lack proper lifecycle management and

rotation, creating persistent vulnerabilities. Greater than a security leader at a Fortune 500 company acknowledged this challenge, we greater than aim to rotate secrets annually, but enforcement is difficult across our greater than environment. Some credentials have remained unchanged for years. Secrets Managers Not a complete answer even organizations using secrets management solutions remain vulnerable. A study of 2,584 repositories leveraging secrets managers revealed a 5.1% secret leakager rate, far from the near zero we anticipate. This surpasses the overall GitHub average of 4.6%.

Common issues include secrets extracted from secrets managers and hard-coded elsewhere, insecure authentication to secrets managers exposing access credentials. Fragmented governance due to secrets sprawl across multiple secrets managers. The path forward. Comprehensive secrets securitya's i-generated code, automation, and cloud-native development accelerate. The report forecasts that secrets sprawl will only intensify. While GitHub's push protection has reduced some leaks, it leaves significant gaps, particularly with generic secrets, private repositories, and collaboration tools.

Greater than, for CISOs and security leaders, the goal isn't just detection, it's the greater than remediation of these vulnerabilities before they're exploited," said Eric Ferrier. This requires a comprehensive approach that includes automated greater-than-discovery, detection, remediation, and stronger secrets governance across all greater-than-enterprise platforms. The report concludes with a strategic framework for organizations to address secrets sprawl through deploying monitoring for exposed credentials across all environments, implementing centralized secrets detection and remediation, establishing semi-automated rotation policies for all credentials, creating clear developer

guidelines for secure vault usage. To read the full 2025 State of Secrets Sprawl Report, users can visit GitGuardian.com, additional resources GitGuardian, website the State of Secrets Sprawl 2025 about GitGuardian.com, additional resources GitGuardian, website The State of Secrets Sprawl 2025 about GitGuardian GitGuardian is an end-to-end NHI security platform that empowers software-driven organizations to enhance their non-human identity, NHI, security and comply with industry standards. With attackers increasingly targeting NHIs, such as service accounts and applications, GitGuardian integratesates secrets security and NHI governance. This dual approach enables the detection of compromised secrets across your dev environments

while also managing non-human identities and their secrets lifecycles. The platform is the world's most installed GitHub application and supports over 450 plus types of secrets, offers public monitoring for leaked data, and deploys honey tokens for added defense. Trusted by over 600,000 developers, GitGuardian is the choice of leading organizations like Snowflake, Ing, BASF, and Buig Telecom for robust secrets protection. Contact Media Contact Holly Hagerman Connect Marketing Holly at ConnectMarketing.com plus 1801-373-7888

Tip This story was distributed as a release by CyberNewsWire under Hacker Noon's Business Blogging Program. Learn more about the program here. And thank you for listening to this Hacker Noon story, read by Artificial Intelligence. Visit HackerNoon.com to read, write, learn and publish.