cyber.hendryadrian.com
Security Report · wiz.io

Wiz Report Finds Widespread Secrets Exposure and CI/CD Risks in Code Repositories

· Original article ↗

Summary

Wiz analyzed hundreds of thousands of repositories and development environments using 2024 data, reporting widespread public-repository secrets, risks from persistent self-hosted runners, and excessive GitHub App permissions.

Key points

  • Wiz says its 2025 report draws on data collected during 2024 from repositories, version-control platforms, and CI/CD pipelines using its Wiz Cloud and Wiz Code platforms.
  • The report says 35% of GitHub repositories are public.
  • It reports that 61% of organizations have public repositories containing cloud secrets such as API keys and access tokens.
  • About 35% of enterprises use non-ephemeral self-hosted CI/CD runners, which the report says can increase lateral-movement risks.
  • Virtual machines hosting runners have, on average, three times as many software packages installed and High/Critical vulnerabilities as other VMs.
  • More than 76% of organization-level GitHub Apps have pull_requests and contents scopes; 80% of Apps with pull_requests have write access, according to the report.

Article Details

Publisher
Wiz
Report Period
Data collected throughout 2024; report published in 2025
Scope
Code repositories, version control systems, and CI/CD pipelines across GitHub, GitLab, and Azure DevOps
Sample Size
Hundreds of thousands of repositories
Key Statistics
  • 35% of GitHub repositories analyzed were public.
  • 61% of organizations had public repositories containing cloud secrets.
  • About 35% of enterprises used non-ephemeral self-hosted CI/CD runners.
  • VMs with runners had, on average, 3 times more software packages installed and High/Critical vulnerabilities than other VMs.
  • Over 76% of organization-level GitHub Apps had pull_requests and contents scopes; 80% of Apps with the pull_requests scope granted write access.
Recommendations
  • Use stricter permissions and better repository management practices.
  • Keep secrets encrypted and store them in dedicated secret management tools.

Products

Azure DevOpsBy analyzing hundreds of thousands of repositories across platforms like GitHub, GitLab, and Azure DevOps, Wiz Threat Research uncovers key risks and misconfigurations that impact production code development andGitHubBy analyzing hundreds of thousands of repositories across platforms like GitHub, GitLab, and Azure DevOps, Wiz Threat Research uncovers key risks and misconfigurations that impact production code development andGitLabBy analyzing hundreds of thousands of repositories across platforms like GitHub, GitLab, and Azure DevOps, Wiz Threat Research uncovers key risks and misconfigurations that impact production code development andWiz CloudTo produce this report, our researchers leveraged data collected throughout 2024 using the Wiz Cloud and Wiz Code platforms. With insights directly derived from real-world code repositories, version control systemsWiz CodeTo produce this report, our researchers leveraged data collected throughout 2024 using the Wiz Cloud and Wiz Code platforms. With insights directly derived from real-world code repositories, version control systems

Related Articles