Every architecture review I have sat in has a slide about the grand design: services, queues, gateways, neat boxes with confident arrows. Almost none have a slide about where the keys live. Yet the keys are what actually open the doors.
Secrets sprawl is what happens when credentials multiply faster than anyone can track them. A token pasted into a CI variable for a quick test. A database password in a config file that “will be rotated later.” An API key shared in a chat thread because the deadline was tomorrow. None of these feel like decisions. They feel like Tuesday. But add up two years of Tuesdays and you have hundreds of live credentials scattered across repositories, pipelines, laptops and wikis, many belonging to people who have since left.
The uncomfortable truth is that attackers rarely break in anymore. They log in. A forgotten key with broad permissions is far cheaper to use than a clever exploit.
The good news is that you do not need a heroic programme to improve. Start with three moves. First, find what exists: run a secrets scanner across your repositories and history, and treat the first report as a map, not a scandal. Second, centralise: move credentials into a managed vault or your cloud provider’s secret manager, and let applications fetch them at runtime instead of carrying them around. Third, shorten lifetimes: prefer short-lived, narrowly scoped credentials over permanent ones, so a leak expires before it matters.
Think of it like an art restorer’s studio. You can have the finest canvases in the building, but if the studio key is under the doormat, the collection is only as safe as the mat. Audit the mat first.