Secrets and config
Secret committed to the repository
A key or token is in git history, where it stays readable to anyone with repository access even after the file changes.
Termsclient bundle (the JavaScript your app sends to the browser or ships inside the mobile app; anyone can read it) · publishable and secret keys (the publishable key may sit in the browser because row-level security limits it; the secret key bypasses those rules and must stay on the server) · security headers (HTTP response headers (HSTS, content-type, frame policy) that switch on the browser's built-in protections) · CI (the pipeline that builds and tests every change before it can be merged or deployed)
criticalseverity if found in a releasesources verified 2026-09-21
Why AI-assisted code produces it
GitGuardian counted 28.65 million new hardcoded secrets on public GitHub in 2025 and measured a 3.2% leak rate in commits co-authored with one AI assistant against a 1.5% baseline, noting the developer still accepts each suggestion.
28.65 million new hardcoded secrets were pushed to public GitHub in 2025, a 34% rise year over year.
Source: GitGuardian, 2026-03-17 · verified 2026-09-21
Commits co-authored with one AI coding assistant showed a 3.2% secret-leak rate against a 1.5% baseline across all public GitHub commits; the report notes the developer still accepts or rejects each suggestion.
Source: GitGuardian, 2026-03-17 · verified 2026-09-21 · denominator: public GitHub commits carrying that assistant's co-author trailer, against all public GitHub commits in 2025
How we detect it
Run a secret scanner across the full history, not the working tree. Treat every finding as live until rotation is recorded.
Checklist items that catch it
No secrets in repository history
tool Run a secret scanner (gitleaks or equivalent) over the full git history, not only the working tree.
Scanner reports zero unrevoked findings; any historical finding has a rotation record.
Dots: Starter, Growth, Scale. The item runs on every release for the plans marked.
More in secrets and config
- critical
- critical
- high
- high
- medium
Check your codebase for this pattern
The coverage audit lists which catalogue patterns apply to your critical flows. 5 business days, $1,200, credited to a first month.