The Secrets Sprawl Problem

Secrets sprawl is the uncontrolled spread of sensitive credentials across an organization. A secret is anything that grants access: API keys, database passwords, OAuth tokens, TLS private keys, SSH keys, and encryption keys.

Sprawl happens when these secrets end up scattered in places they should never live:

• Source code and config files
• CI/CD pipelines and environment variables
• Container images and infrastructure-as-code
• Chat messages, wikis, and ticketing systems

Once a secret exists in many places, you lose the ability to track, rotate, or revoke it reliably.

The most common root cause is the hardcoded secret a credential written directly into source code. It feels convenient during development but becomes a permanent liability.

Here is what a hardcoded database password looks like in application code:

Anyone with read access to this file now has the production password. That includes every developer, every CI runner, and anyone who later clones the repo.