Simplify

A Secrets Manager Does Not Stop Secret Sprawl

The vault worked exactly as designed

An engineer retrieves a database credential from the approved vault, pastes it into a temporary debug command, and later copies the terminal output into a Confluence incident page. The vault authenticated the request, logged the read, and never lost control of its own storage. The organization still has a plaintext credential in a wiki.

This is the copy problem: secure storage does not impose policy on every representation created after retrieval.

GitGuardian’s State of Secrets Sprawl 2025 found that 5.1% of public repositories using a secrets manager still leaked secrets in 2024. The report does not say secret managers are ineffective, and its detection of manager usage may not capture every implementation. It demonstrates the architectural limit: adoption of a vault does not make downstream plaintext copies impossible.

Copy-propagation diagram: an authorized read from a secrets manager can create plaintext in a process environment, terminal log, Jira issue, Confluence page, or git commit; the vault governs the source copy but not every downstream copy.

Separate custody, delivery, and detection

Custody protects the canonical secret, applies authorization, and records access.

Delivery gets authority to the intended workload without unnecessary human exposure. Dynamic, short-lived credentials and workload identity are strongest when available.

Detection finds copies that escaped the intended path. It must cover code, build output, collaboration systems, and other stores where humans move diagnostic context.

OWASP’s Secrets Management Cheat Sheet recommends limiting human interaction, using dynamic secrets where possible, automating rotation, and applying fine-grained access to each object. It also states that secrets must be revocable and never logged. Those are lifecycle properties, not features a storage product can enforce alone.

Measure uncontrolled copies

A useful security program tracks more than vault adoption. Measure findings by surface, credential owner, validity, time to revoke, recurrence after remediation, and whether a safer delivery path existed. A falling count can indicate improvement—or a scanner losing coverage—so pair it with controlled recall testing.

Secret Sentinel supplies detection and redaction for Jira and Confluence, where approved vault credentials often reappear in incident and setup content. It does not replace the vault. envseal offers an encrypted git-based delivery option for teams whose workflow needs versioned .env configuration and per-recipient access. It likewise does not make an already exposed upstream credential validly “safe.”

The mature design is not “we bought a secrets manager.” It is: canonical custody is controlled, delivery minimizes plaintext, escaped copies are detected, and every credential can be revoked.

Frequently asked questions

Why scan for secrets if we already use a managed vault?

The vault controls retrieval of its own copy. Scanning detects uncontrolled copies created in source, logs, tickets, wiki pages, images, or exported diagnostics.

Should applications use static secrets from a vault?

Prefer short-lived or dynamic credentials where the platform supports them. Static credentials still need least privilege, rotation, revocation, and detection outside the vault.