qualitylab

Adversarial exposure · Blast radius

No secret is ever committed, and something checks

tier II/cost to adopt: low/active

Hard-coded credentials in configuration and infrastructure code are common, long-lived, and accepted as real defects by maintainers when pointed at — a mechanical check is the only thing that has been shown to find them.

Do this firstNothing. This is a place to start.

This is the first control on the adversarial-exposure sector, and it is deliberately the dullest one available.

What the measurement shows is not that engineers do not know better. It is that knowing better does not remove the secrets: they were found at scale in open-source infrastructure code, they persisted for a median of twenty months, and when maintainers were shown them they agreed they were defects roughly two-thirds of the time. The gap is between intent and detection, and only the detection half is automatable.

The replication at larger scale — 50,323 scripts, 46,600 occurrences, 7,849 hard-coded passwords — found the same pattern in a different tool ecosystem, so this is not an artefact of one configuration language.

The decoy

A policy saying not to. Prevalence was measured against codebases that all had such a policy: 21,201 smell occurrences across 15,232 infrastructure scripts, including 1,326 hard-coded passwords, with a median lifetime of 20 months and one surviving 98.

Evidence

Last reviewed 2026-08-19.