Adversarial exposure · Blast radius
No secret is ever committed, and something checks
Hard-coded credentials in configuration and infrastructure code are common, long-lived, and accepted as real defects by maintainers when pointed at — a mechanical check is the only thing that has been shown to find them.
Do this firstNothing. This is a place to start.
This is the first control on the adversarial-exposure sector, and it is deliberately the dullest one available.
What the measurement shows is not that engineers do not know better. It is that knowing better does not remove the secrets: they were found at scale in open-source infrastructure code, they persisted for a median of twenty months, and when maintainers were shown them they agreed they were defects roughly two-thirds of the time. The gap is between intent and detection, and only the detection half is automatable.
The replication at larger scale — 50,323 scripts, 46,600 occurrences, 7,849 hard-coded passwords — found the same pattern in a different tool ecosystem, so this is not an artefact of one configuration language.
The decoy
A policy saying not to. Prevalence was measured against codebases that all had such a policy: 21,201 smell occurrences across 15,232 infrastructure scripts, including 1,326 hard-coded passwords, with a median lifetime of 20 months and one surviving 98.
Evidence
- State of Secrets Sprawl Report 2024 — IICommitted secrets are pervasive and overwhelmingly go unrotated after exposure: more than 90% remained valid five days after leaking, and only 2.6% of leaks were revoked within an hour of notification — after 1.8 million pro-bono alert emails. Detection without enforced rotation is a weak control.
- The Seven Sins: Security Smells in Infrastructure as Code Scripts — II21,201 smell occurrences including 1,326 hard-coded passwords. Of 1,000 sampled occurrences reported to maintainers, 104 drew a response and 67 were accepted as real defects. Median smell lifetime 20 months, with one hard-coded secret persisting 98.
Last reviewed 2026-08-19.