The Invisible Attack Surface: Why Comprehensive Detection is the New Baseline for Credential Security

Internal repositories often house a vast population of "working" credentials—those used by developers and applications for daily tasks, including access to internal databases and cloud environments. GitGuardian’s research indicates that internal repositories are roughly six times more likely than public ones to contain at least one secret.

Beyond code, collaboration and productivity systems have emerged as a significant source of exposure. Around 28% of secret-related incidents originate outside of source-code repositories. Credentials are often pasted into Jira tickets, shared via Slack or Microsoft Teams during handoffs, or documented in Confluence pages. These secrets can remain searchable and accessible long after the project they supported has been completed, providing a goldmine for attackers who have gained initial access to a corporate network.

The Developer Laptop: The New Front Line

While much attention is paid to cloud environments and repositories, the developer laptop has emerged as a high-value target. For years, it was common practice for developers to use local environment files and command-line tools that cache credentials. This was seen as a low-risk convenience until attackers shifted their tactics.

The end of 2025 and the beginning of 2026 saw a rise in sophisticated "infostealer" malware campaigns, such as Shai-Hulud and S1ingularity. These attacks specifically target developer machines to harvest authentication material that can be used to pivot into the broader software supply chain. An unscrubbed local shell history or a forgotten .env file can provide the keys to an entire production environment.

Every developer laptop is an active part of the enterprise credential layer. Repository scanning only shows what has been committed; it does not account for the secrets that live on the endpoints where code is created. To truly map the credential layer, organizations must bridge the gap between central monitoring and endpoint discovery.

AI Agents and the Density of Local Secrets

The introduction of AI coding agents has added a new dimension to endpoint risk. These agents have the ability to read files, execute commands, and interact with external services via protocols like the Model Context Protocol (MCP). Each of these connections requires authentication, creating a new wave of credentials that often bypass traditional management systems.

GitGuardian’s analysis of the Shai-Hulud 2 campaign provided a rare glimpse into the density of secrets on these compromised machines. Across nearly 7,000 infected systems, researchers found over 33,000 unique secrets. Nearly half of the machines held more than 10 secrets, and 5% held more than 100. This density makes developer machines an incredibly lucrative target for automated malware.

Furthermore, the way AI agents are authenticated is creating new vulnerabilities. In 2025 alone, over 24,000 unique secrets were found in public MCP configuration files, with thousands of them verified as valid. When an AI agent has access to a credential, it can take actions that the human developer might not anticipate—such as accidentally deleting a production database or exposing sensitive data through an external API. Understanding what these agents can access is a prerequisite for managing AI risk.

The Critical Role of Context in Discovery

Finding a secret is only the first step. To manage risk effectively, security teams need the surrounding context to prioritize their response. Without context, a list of 28 million secrets is simply noise.