Comprehensive Secrets Management & Leakage Guide
Comprehensive Secrets Management & Leakage Guide 🆕 Updated September 12, 2026 — added the Bun-based npm credential stealer (April 2026): payloads that download their own runtime, and public dead-drop repos as an IOC. A practitioner’s reference for secrets sprawl, credential leakage, detection, remediation, and hardening. Draws on GitGuardian State of Secrets Sprawl 2025/2026, OWASP Secrets Management Cheat Sheet, TruffleHog, Gitleaks, real-world breaches (Trivy/European Commission, Shai-Hulud, LiteLLM, EleKtra-Leak, .env extortion campaigns, GCP SecOps SIEM token leak), AI-era leakage patterns (Claude Code source leak, vibe-coding fingerprints, ChatGPT API key exposure), certificate/private key leak research (Google-GitGuardian), GitHub search syntax for secret discovery, vault hardening (HashiCorp Vault production guide, AWS SM vs Vault, Infisical, SOPS+age), Terraform/Kubernetes secrets management, IAM Roles Anywhere, shift-left speed budgets, and NHI governance guidance. ...