GitGuardian-State-of-Secrets-Sprawl-2026.md

### Executive summary GitGuardian's 2026 State of Secrets Sprawl documents a dramatic rise in hardcoded credential exposure driven by AI-assisted development and expanded AI infrastructure: 28.65 million new public GitHub secrets in 2025, large numbers of valid credentials persisting for years, targeted supply-chain and consulting-firm breaches (including a 570GB exfiltration affecting ~800 orgs), a credential-harvesting malware campaign (Shai-Hulud), and a critical MCP registry vulnerability that led to arbitrary code execution and widespread secret compromise — concluding that secrets sprawl is now a governance and identity problem requiring NHI-focused controls.