Secrets in code
In this section, we’ll talk about secrets that end up in source code and why it’s a much bigger problem than some people think. In GitGuardian’s 2024 State of Secrets Sprawl report,1 we described how we found 12.8 million new incidents of secrets being committed to GitHub in plain text. We also found exposed secrets in the source code of third-party components from the Python Package Index (PyPI).
How do secrets end up in code?
In simple terms, adding secrets directly to the code or a plain-text file of environment variables is often seen as the quickest and least thought-intensive way to use them. Developers add the secret as a string value and then use it wherever needed. It might be in the code itself or it may be in a plain-text file of environment variables that gets read and used by the software. This then ends up in their commit history if they haven’...
