Why Security Teams Need Visibility Across the Expanding Credential Layer
Summary
As software development and AI-agent use accelerate, credentials spread across repositories, collaboration tools, and developer devices. The article argues that teams need broad discovery and context to understand exposure and prioritize remediation.
Key points
- GitGuardian says it detected 28.65 million new hardcoded secrets in public GitHub commits in 2025, up 34% year over year.
- The article says internal repositories were about six times more likely than public repositories to contain a secret, and roughly 28% of secrets incidents began outside source-code repositories.
- Developer endpoints can hold credentials in local files, command histories, and application storage, making them a potential supply-chain entry point.
- In GitGuardian's analysis of 6,943 systems compromised in the Shai-Hulud 2 campaign, researchers identified 33,185 unique secrets; 44% of systems held more than 10.
- GitGuardian reports finding 24,008 unique secrets in public MCP configuration files during 2025, of which 2,117 were verified as valid.
- The article recommends building a credential inventory across repositories, public exposure, and endpoints, with context on validity, ownership, permissions, and dependencies.
Article Details
- Topic
- The expanding enterprise credential layer and the need to discover credentials across repositories, developer endpoints, and collaboration systems
People
Malware
S1ingularityThen the attackers shifted. The end of 2025 brought new waves of infostealer attacks like Shai-Hulud and S1ingularity, which turned the developer laptop into a target and an entry point into the supply chain.Shai-HuludThen the attackers shifted. The end of 2025 brought new waves of infostealer attacks like Shai-Hulud and S1ingularity, which turned the developer laptop into a target and an entry point into the supply chain.Shai-Hulud 2GitGuardian's analysis of systems compromised during the Shai-Hulud 2 supply-chain campaign provides a rare view into the density of credentials on these machines. Across 6,943 compromised systems, researchers
Vendors
GitGuardianThis is how humans, systems, and now AI, all connect to data, services, and each other securely. GitGuardian helps secure that credential layer through three connected capabilities: Detect, Remediate, andGitHubproduction is accelerating beyond the growth assumptions that shaped many of today's security controls. GitHub COO Kyle Daigle said the platform had gone from roughly 1 billion commits during all of 2025 to 2.9