Secrets-scanning tools have gotten good. GitGuardian, TruffleHog, and a dozen competitors will find a hardcoded API key in a commit within minutes of it landing. That’s real progress — and it hasn’t solved the problem it was built for.
GitGuardian’s State of Secrets Sprawl 2026 report found that 64% of secrets leaked in 2022 are still valid today. Four years later. Detected, presumably logged somewhere, and never actually rotated or revoked. Leaked secrets have grown 152% since 2021 — outpacing the 98% growth in GitHub’s developer population over the same period, meaning credentials are multiplying faster than the people who own them.
Detection was never the hard part
Finding a leaked secret is a search problem. Fixing it is an organizational and architectural one: someone has to know which service the credential belongs to, confirm rotating it won’t break production, coordinate the change, and verify the old value is actually dead — not just marked as found. At the scale of a modern microservices environment, with hundreds or thousands of services, that process doesn’t happen by hand. It has to be designed away.
The report’s other findings point at where the design work matters most. Internal repositories leak secrets at six times the rate of public ones — the places engineering teams assume are safe are the places with the least scrutiny. Nearly 28% of leaks happen entirely outside code, in Slack, Jira, and Confluence, where scanning tools rarely look at all. And AI agent connections — a category that barely existed two years ago — already exposed more than 24,000 secrets in 2025 alone.
The fix is removing the credential, not finding it faster
The only durable answer to a standing secret is not having one. Modern workload identity standards replace long-lived API keys and service-account passwords with short-lived, cryptographically verifiable identities, issued automatically per system and rotated on the order of minutes. A credential that expires before an attacker can use it is worth more than a credential that’s merely well-hidden.
That’s a real engineering project, not a product install — which is exactly why most organizations that pilot automated workload identity stall somewhere in the middle of the rollout. It touches every service, and someone has to actually do the migration work, service by service, in priority order.
That migration is the whole scope of SecNiva’s Machine Identity & Secrets Modernization engagement: an inventory of what’s actually exposed, a target architecture, and hands-on implementation starting with the services where a leaked credential would do the most damage.