The Expanding Attack Surface: How Secret Sprawl Creates Enterprise Vulnerabilities

The Growing Epidemic of Secret Sprawl

In today’s interconnected digital landscape, organizations are facing an increasingly dangerous threat: the uncontrolled proliferation of sensitive credentials across multiple platforms. What security experts term “secret sprawl” represents a fundamental shift in how attackers approach data compromise, moving beyond traditional code repositories to target sensitive information wherever it resides.

Recent high-profile incidents demonstrate that exposed API keys, authentication tokens, and credentials are no longer confined to developer environments. According to security researchers, threat actors are systematically exploiting what Guillaume Valadon, security researcher at GitGuardian, calls “bad secret hygiene” to advance their campaigns. “They know that secrets are everywhere,” Valadon emphasizes, highlighting the systematic nature of these attacks., as additional insights

Case Study: The Salesforce Compromise Chain

The recent attacks against Salesforce instances illustrate how devastating secret exposure can become. A threat group tracked as UNC6395 obtained OAuth tokens from Salesloft Drift, a third-party application, then used these tokens to compromise multiple customer Salesforce environments. The initial breach originated from a compromised GitHub account that provided access to Salesloft’s private repositories, creating a dangerous chain of exposure., according to market developments

Cloudflare’s disclosure following these attacks revealed the unexpected places where sensitive data accumulates. Their Salesforce instances contained technical support cases where customers had submitted logs, credentials, and over 100 API tokens for troubleshooting. “Anything shared through this channel should now be considered compromised,” Cloudflare warned, highlighting the need for organizations to reassess where sensitive data might reside.

Darren Meyer, research advocate at Checkmarx Zero, notes that these incidents have fundamentally changed application security priorities. “In modern software development workflows, AppSec doesn’t have the luxury of trusting repositories,” Meyer explains, emphasizing that security teams must now ensure robust protection of development resources beyond simply identifying and removing secrets.

Supply Chain Dangers Amplify the Threat

The consequences of secret sprawl extend far beyond individual organizations, creating significant supply chain risks. The recent Red Hat breach demonstrates how exposed secrets can compromise entire customer ecosystems. When threat actors accessed Red Hat’s GitLab instance and thousands of private repositories, they also claimed to have stolen customer engagement reports containing client access tokens.

Similarly, research from Wiz uncovered that many organizations had exposed secrets in Visual Studio Code marketplaces. Their investigation revealed more than 550 validated secrets from hundreds of extension publishers, including access tokens that could enable threat actors to tamper with extensions and launch widespread supply chain attacks.

The researchers noted that many exposed secrets originated from AI providers including OpenAI, Google Gemini, Anthropic, and major cloud platforms, indicating that the rapid adoption of AI technologies has introduced new vectors for secret exposure.

The AI Factor: Accelerating Secret Proliferation

Security experts identify AI adoption as a significant contributor to the secret sprawl epidemic. Rami McCarthy, principal security researcher at Wiz, observes that “increased adoption of AI coding assistants and generative AI platforms have led to bad patterns of secrets management,” such as storing plaintext secrets in configuration files.

Carole Winqwist, CMO at GitGuardian, confirms this trend, noting that “it’s getting worse every year, for different reasons.” She explains that AI coding assistants often require secrets to connect to other resources, and the code is frequently produced by non-professional developers with limited security knowledge. “There is also the problem that more and more code is being produced, and the AI agents are multiplying the volume of secrets that are leveraged by the different systems,” Winqwist adds.

Strategies for Containment and Protection

Security experts recommend a multi-pronged approach to combat secret sprawl:

• Comprehensive Secret Monitoring: Implement continuous scanning for secrets across both internal development environments and external resources like application marketplaces and collaboration platforms.
• Privilege Restriction: Use short-term credentials and strictly limit privileges for tokens and API keys. Some organizations now employ access tokens that only function from designated regions or specific IP addresses.
• Eliminate Over-Privileging: Winqwist emphasizes that organizations must stop the common practice of over-privileging secrets. “When they give a key to a system or a third-party, companies tend to over-privilege it because it’s easier that way. The worst is, a lot of organizations use the same key for test environments and production environments.”
• Enhanced Access Controls: Strengthen authentication mechanisms around developer resources and implement multifactor authentication for all accounts with access to sensitive systems.

As Valadon starkly observes, the problem extends to unexpected places: “People put secrets in Slack, and that’s a bit crazy.” This reality underscores the need for organizations to assume that secrets have spread beyond traditional boundaries and implement comprehensive detection and remediation strategies.

The battle against secret sprawl requires both technological solutions and cultural changes in how organizations manage sensitive credentials. As development practices evolve and AI tools become more integrated into workflows, maintaining strong secret hygiene will remain a critical component of enterprise security.

References & Further Reading

This article draws from multiple authoritative sources. For more information, please consult:

• https://www.cybersecuritydive.com/news/cloudflare-proofpoint-hackers-salesforce-instances/759126/

This article aggregates information from publicly available sources. All trademarks and copyrights belong to their respective owners.

Note: Featured image is for illustrative purposes only and does not represent any specific product, service, or entity mentioned in this article.