Cloud Infrastructure
Secrets & API Keys in Code
Hard-coded credentials in source code are scraped by automated tools within minutes of being pushed.
What it is
API keys, cloud credentials, database connection strings, and private keys committed to source repositories are discovered by automated scanning tools that continuously monitor public repositories. GitHub's secret scanning found over 39 million exposed secrets in public repositories in 2024 — more than triple the 2023 figure. Internal repositories are not safe either — build pipelines, CI/CD logs, and container images frequently contain credentials in plaintext.
Attack techniques
- Repository secrets scanning by attackers
- CI/CD pipeline secrets exposure
- Container image inspection for secrets (T1552.007)
- Environment variable leakage
- Hard-coded credentials (T1552.001)
Business impact
A leaked cloud API key gives immediate, authenticated access to cloud infrastructure — often with the same permissions as the developer who committed it.