If you know where to look, exposed secrets are easy to find. Secrets are supposed to prevent unauthorized access, but in the wrong hands, they can be—and typically are—exploited in seconds.<\/p>\n
To give you an idea of the scope of the problem, more than 39 million secrets<\/strong> were leaked across GitHub in 2024 alone.1<\/a><\/sup> Every minute<\/em> GitHub blocks several secrets with push protection.2<\/a><\/sup> Still, secret leaks remain one of the most common—and preventable—causes of security incidents. As we develop code faster than ever previously imaginable, we’re leaking secrets faster than ever, too.<\/p>\n That’s why, at GitHub, we’re working to prevent breaches caused by leaked tokens, credentials, and other secrets—ensuring protection against secret exposures is built-in and accessible to every developer. <\/span><\/p>\n Today, we’re launching the<\/strong> next evolution of GitHub Advanced Security<\/strong><\/a>, aligning with our ongoing mission to keep your secrets…secret<\/strong>.<\/p>\n Here’s how secrets leak, what we’re doing to stop it, and what you can do to protect your code. Let’s jump in.<\/p>\n Most software today depends on secrets—credentials, API keys, tokens—that developers handle dozens of times a day. These secrets are often accidentally exposed. Less intuitively, a large number of breaches come from well-meaning developers who purposely expose a secret. Developers also often underestimate the risk of private exposures, <\/strong>committing, sharing, or storing these secrets in ways that feel convenient in the moment, but which introduce risk over time.<\/strong><\/p>\n Unfortunately, these seemingly innocuous secret exposures are small threads to pull for an attacker looking to unravel a whole system. Bad actors are extremely skilled at using a foothold provided by “low risk” secrets for lateral movement to higher-value assets. Even without the risk of insider threats, persisting any secret in git history (or elsewhere) makes us vulnerable to future mistakes. Research<\/a> shows that accidental mistakes (like inadvertently making a repository public) were higher in 2024 than ever before.<\/p>\n If you’re interested in learning more about secret leaks and how to protect yourself, check out this great video from my colleague Chris Reddington:<\/em><\/p>\n\n
How do secret leaks happen?<\/span><\/a><\/h2>\n