Secret sprawl

What is secret sprawl?

Secret sprawl is the uncontrolled spread of credentials (API keys, database passwords, tokens, private keys, webhook secrets) across places they were never meant to live: source code, git history, config files, CI logs, environment dumps, Docker images, wikis, and chat threads. Each copy is an unmanaged access point that nobody rotates, nobody monitors, and nobody remembers. The defining property of sprawl is that the organization no longer knows where all its secrets are, which means it cannot revoke access with confidence when an employee leaves, a laptop is stolen, or a repository leaks.

How it shows up in real code

The classic specimen is a credential committed directly:

const stripe = new Stripe("sk_live_51Hxxxxxxxxxxxxxxxxxxxxxx");

Equally common variants: a .env file that was gitignored two years after the repo started (the early commits still contain it), keys pasted into Slack “just this once”, credentials baked into a Docker layer, and CI pipelines that echo environment variables into public logs. Git history is the multiplier: a secret removed in yesterday’s commit remains fully readable in every clone, and automated scanners crawl public repositories for exactly these patterns within minutes of a push. A key that has ever been committed must be treated as compromised; deleting the line does not unpublish it.

The fix

The remediation pattern has three steps: detect (scan the codebase and full git history with tools like Gitleaks or TruffleHog), rotate (revoke every exposed credential, since removal without rotation fixes nothing), and centralize (move secrets into a manager such as Vault, or AWS, GCP, or Doppler secret stores, injected at runtime, with pre-commit scanning to keep new leaks out).

Why it matters in a code audit

Leaked secrets are the highest ratio of severity to discovery effort an audit encounters: a single live key can equal full database or payment access, and finding it takes a scanner plus a human pass for the formats scanners miss. Auditors check the history, not just the working tree, and read the process signal too, because sprawl usually indicates there is no secret management practice at all. Sprawl is a standing pile of technical debt with a security fuse attached, and each exposed key in a dependency or vendor context can intersect with known CVEs to widen the blast radius; it sits alongside the top vulnerabilities code audits catch in nearly every report.

A free code audit includes a history-deep scan for exactly this kind of leak.