# Credential Layer Exposure: Hardcoded and Long-Lived Secrets Sprawl Across Repos, CI/CD, Laptops and Secrets Managers

> GitGuardian's State of Secrets Sprawl 2026 and its 30 Oct 2026 'credential layer' article report 28.65 million new hardcoded secrets in public GitHub commits in 2025 (+34% YoY) and that 64% of secrets confirmed valid in 2022 were still valid in January 2026. This is a landscape-level exposure trend, not a single incident, CVE or named-actor campaign.

- **Published:** 2026-10-31T02:51:48Z
- **Last reviewed:** 2026-10-31T02:51:48Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4874
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4874.png
- **ID:** TL-2026-4874
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 10

## Description

This record documents a landscape-level credential exposure risk rather than a discrete exploit or campaign. GitGuardian defines the 'credential layer' as every surface where credentials are created, stored, transmitted or used: source repositories, CI/CD pipelines, developer laptops, collaboration tools (tickets, chat, wikis, shared drives), Kubernetes clusters and secrets managers. Its State of Secrets Sprawl 2026 report (5th edition, covered by The Hacker News on 2026-03-30) counted 28,649,024 new hardcoded secrets in public GitHub commits during 2025, a 34% year-over-year increase and the largest single-year jump recorded. Over five years (2021-2025) leaked secrets grew 152% against 98% growth in public active developers, so secrets are leaking about 1.6x faster than the developer population grows. Secrets tied to AI services grew about 81% year over year (1,275,105 incidents); eight of the ten fastest-growing secret categories were AI-related (for example OpenRouter 48x, DeepSeek 23x, Brave Search 13.5x, Firecrawl 9x). Internal repositories showed a leak rate of 32.2% versus 5.6% for public repositories (roughly 6x), and 28% of incidents originated entirely outside source code, in collaboration platforms, where 56.7% of collaboration-only leaks were rated critical versus 43.7% for code-only incidents. Self-hosted GitLab instances and Docker registries showed 3-4x higher exposure than public GitHub; in one analysis 80,000 credentials were found and 10,000 were still valid, and 18% of Docker images contained secrets with 15% still valid.

The report also found 24,008 unique secrets in Model Context Protocol (MCP) configuration files on public GitHub, of which 2,117 were verified valid; the most common types were Google API keys (19.2%), PostgreSQL connection strings (14%), Firecrawl keys (11.9%), Perplexity keys (11.2%) and Brave Search keys (11%). Commits co-authored by Claude Code leaked secrets at about 2x the baseline rate, with 3.5 million AI-assisted commits by October 2025. Analysis of the Shai-Hulud 2 supply-chain compromise covered 6,943 compromised systems holding 294,842 secret occurrences and 33,185 unique secrets; 59% of the machines were CI/CD runners, 44% held 10 or more secrets and 5% held over 100. Long-lived secrets accounted for 60% of policy breaches, and 46% of critical secrets lacked a validity checker.

The 2026-10-30 GitGuardian blog article adds that 64% of secrets confirmed valid in 2022 were still valid when retested in January 2026 (the report notes only 36% were rotated over four years). Developer laptops hold roughly 150 secrets each on average. GitGuardian research reached 44 active Kubernetes clusters through leaked secrets, and 30% of the exposed clusters had been exposed for over two years. The article also cites a Sysdig-reported intrusion: on 2025-11-28 an attacker found valid IAM user access keys in a public S3 bucket holding AI training data, enumerated IAM users and keys, created new administrative access keys, escalated through Lambda code injection against an over-privileged execution role and moved across 19 unique AWS principals, reaching admin access in about 8 minutes. Sysdig published the analysis on 2026-02-03 and stressed that no zero-day was involved, only long-lived keys and over-broad roles. The article names OWASP Kubernetes Top 10 risk K03 (Secrets Management Failures).

Cited risk scenarios: credentials copied into local configuration files during troubleshooting and later committed; hardcoded credentials in MCP servers used by AI coding assistants; long-lived static plaintext credentials giving persistent access while they remain valid; the same secret reused across repositories, pipelines, tickets and local files; and revocation without dependency mapping causing production outages, which discourages remediation. The key defensive lesson is that detection is not remediation: a secret that is found but not rotated or revoked remains exploitable.

Defensive guidance in the sources: map credential consumers and dependencies before revocation; re-validate after remediation and track 'closed but valid' incidents; move unmanaged secrets into approved vaults (AWS Secrets Manager, Delinea, CyberArk Conjur); cover developer endpoints via MDM (Jamf, Intune, Iru/Kandji) as well as repositories; scan CI/CD, collaboration tools and secrets-manager inventories; use honeytokens; prefer short-lived credentials; and combine enrichment, context, risk scoring and full coverage including non-validated secrets. The sources contain no CVE, named threat actor, malware family or network IOCs; the IOC list therefore holds behavioral, tool, platform and entity indicators only, all taken from the cited material.

## MITRE ATT&CK

- T1552 Unsecured Credentials
- T1552.001 Unsecured Credentials: Credentials In Files
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1078.004 Valid Accounts: Cloud Accounts
- T1530 Data from Cloud Storage
- T1213.003 Data from Information Repositories: Code Repositories
- T1098.001 Account Manipulation: Additional Cloud Credentials
- T1087.004 Account Discovery: Cloud Account
- T1078 Valid Accounts
- T1648 Serverless Execution
- T1195.002 Compromise Software Supply Chain

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Secret Scanner (TruffleHog/Gitleaks) Executed on Endpoint or CI Runner — Exploitation Phase** (`TL-2026-4874-SPL-001`)

Detects execution of open-source secret scanners (TruffleHog v3, Gitleaks, detect-secrets, ggshield) on Windows endpoints and CI runners, especially with --only-verified or broad filesystem/org/bucket scope. Attackers reuse these tools to harvest hardcoded and long-lived credentials from developer laptops and CI/CD runners, as in the Shai-Hulud 2 analysis (6,943 systems, 33,185 unique secrets) cited in the credential layer exposure research (TL-2026-4874, T1552.001).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1552.001, T1552, T1195.002
- **Data sources:** sysmon, microsoft_defender_for_endpoint
- **Severity:** medium
- **Confidence:** medium

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
| eval cmd=lower(CommandLine), img=lower(Image)
| where match(img,"(trufflehog|gitleaks|detect-secrets|ggshield)") OR match(cmd,"(trufflehog|gitleaks (detect|dir|git)|detect-secrets scan|ggshield secret scan)")
| eval verified_only=if(match(cmd,"--only-verified|--results=verified"),1,0), broad_scope=if(match(cmd,"(filesystem|--org|--bucket| dir )"),1,0)
| eval risk=case(verified_only=1 AND broad_scope=1,"high",verified_only=1 OR broad_scope=1,"medium",true(),"low")
| stats count AS executions values(CommandLine) AS cmdlines values(ParentImage) AS parents min(_time) AS first_seen max(_time) AS last_seen BY host, User, risk
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| extend Cmd = tolower(ProcessCommandLine)
| where tolower(FileName) matches regex @'(trufflehog|gitleaks|detect-secrets|ggshield)' or Cmd matches regex @'(trufflehog|gitleaks (detect|dir|git)|detect-secrets scan|ggshield secret scan)'
| extend VerifiedOnly = Cmd matches regex @'--only-verified|--results=verified', BroadScope = Cmd matches regex @'(filesystem|--org|--bucket| dir )'
| extend Risk = case(VerifiedOnly and BroadScope, 'high', VerifiedOnly or BroadScope, 'medium', 'low')
| summarize Executions = count(), CmdLines = make_set(ProcessCommandLine, 10), Parents = make_set(InitiatingProcessFileName, 5), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, AccountName, Risk
```

### Sigma

```yaml
title: Secret Scanner Executed on Endpoint or CI Runner (TruffleHog/Gitleaks)
id: 3f6a2c1e-8b47-4d52-9a13-5c0e7d1b2a41
status: experimental
description: Detects execution of open-source secret scanners (TruffleHog v3, Gitleaks, detect-secrets, ggshield) on endpoints, a technique used to harvest hardcoded credentials from developer machines and CI runners (credential layer exposure, TL-2026-4874).
references:
  - https://blog.gitguardian.com/credential-layer-security-in-practice/
  - https://www.gitguardian.com/state-of-secrets-sprawl-report-2026
author: Threadlinqs Team
date: 2026/10/31
tags:
  - attack.credential_access
  - attack.t1552.001
  - attack.initial_access
  - attack.t1195.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\trufflehog.exe'
      - '\gitleaks.exe'
      - '\ggshield.exe'
  selection_cmd:
    CommandLine|contains:
      - 'trufflehog filesystem'
      - 'trufflehog git'
      - 'trufflehog github'
      - 'trufflehog s3'
      - '--only-verified'
      - 'gitleaks detect'
      - 'detect-secrets scan'
      - 'ggshield secret scan'
  condition: 1 of selection_*
falsepositives:
  - Authorized AppSec or DevSecOps teams running secret scanning
  - Pre-commit hooks and CI secret-scanning jobs
level: medium
```

**Known false positives:**

- Authorized AppSec/DevSecOps teams running TruffleHog, Gitleaks or ggshield
- Pre-commit hooks and scheduled CI secret-scanning jobs on build agents

**Tuning notes:** Allowlist the service accounts, hosts and parent processes of your sanctioned secret-scanning pipelines. Raise severity when --only-verified is used on a developer laptop or when the scanner binary runs from a temp or user-writable path. Add a Linux Sysmon or auditd variant for CI runners.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Mass Git Repository Clone or Mirror by Single Account — Exploitation Phase (locked: unlock with TL Creds)
- S3 Bucket Made Public or Public Access Block Removed — Post-Exploitation Phase (locked: unlock with TL Creds)
- Kubernetes Secrets Read Across Multiple Namespaces — C2 / Lateral Movement Phase (locked: unlock with TL Creds)
- IAM Enumeration Burst by Long-Lived IAM User Key — Exploitation Phase (locked: unlock with TL Creds)
- Credential and MCP Config File Read or Staged via Shell — Post-Exploitation Phase (locked: unlock with TL Creds)
- Package Manager Lifecycle Script Spawning Secret Harvesting — C2 / Lateral Movement Phase (locked: unlock with TL Creds)
- IAM Enumeration Followed by CreateAccessKey From Same IAM User — Post-Exploitation Phase (locked: unlock with TL Creds)
- Lambda Code or Config Change Combined With AssumeRole Fan-Out — C2 / Lateral Movement Phase (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [How GitGuardian Secures the Credential Layer: From Discovery to Remediation](https://blog.gitguardian.com/credential-layer-security-in-practice/)
- [State of Secrets Sprawl 2026 (GitGuardian report)](https://www.gitguardian.com/state-of-secrets-sprawl-report-2026)
- [The State of Secrets Sprawl 2026 (The Hacker News)](https://thehackernews.com/2026/03/the-state-of-secrets-sprawl-2026-9.html)
- [The State of Secrets Sprawl 2026: AI Service Leaks Surge 81% and 29M Secrets Hit Public GitHub (GitGuardian, DEV Community)](https://dev.to/gitguardian/the-state-of-secrets-sprawl-2026-ai-service-leaks-surge-81-and-29m-secrets-hit-public-github-2bgj)
- [AI-Assisted Cloud Intrusion Achieves Admin Access in 8 Minutes (Sysdig)](https://www.sysdig.com/blog/ai-assisted-cloud-intrusion-achieves-admin-access-in-8-minutes)
- [AI-Assisted Cloud Intrusion: Admin Access in 8 Minutes (CSA Research Note)](https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-assisted-cloud-intrusion-8min-admin-acc/)
- [Exposed AWS Credentials Lead to AI-Assisted Cloud Breach in 8 Minutes (Hackread)](https://hackread.com/8-minute-takeover-ai-hijack-cloud-access/)
- [Secrets Sprawl and Rotation: A Practical Vault Management Playbook (DevOps.com)](https://www.devops.com/secrets-sprawl-and-rotation-a-practical-vault-management-playbook)
- [Secrets Sprawl Statistics (AppSecSanta)](https://appsecsanta.com/research/secrets-sprawl-statistics)
- [OWASP Kubernetes Top Ten (K03: Secrets Management Failures)](https://owasp.org/www-project-kubernetes-top-ten/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4874