State of Secrets Sprawl Report 2024
https://www.gitguardian.com/state-of-secrets-sprawl-report-2024
Method
"In 2023, GitGuardian scanned 1.1B commits (+10.6%)"
Population
"12,778,599 new secrets detected and 3,698,686 unique secrets detected across 3 Million repositories"
What it does not show
Public repositories only, so it understates total exposure across private repos, CI logs and images. Measures validity and exposure, not exploitation or breach outcomes, and reports no comparison group of organisations with automated rotation.
GitGuardian
Committed secrets are pervasive and overwhelmingly go unrotated after exposure: more than 90% remained valid five days after leaking, and only 2.6% of leaks were revoked within an hour of notification — after 1.8 million pro-bono alert emails. Detection without enforced rotation is a weak control.
Tier II: Large-scale observational measurement of real public commit history with no control group or intervention. Vendor-collected using its own detection rules and not independently audited.