Rethinking Secrets Management Tools: Why Vaults Alone Aren’t Enough

Secrets management tools like HashiCorp Vault, AWS Secrets Manager, and Azure Key Vault have become essential in modern development environments. These “vault” solutions centralize secrets storage, enforce access policies, and provide audit trails. But in 2025, relying on a vault alone is no longer enough.

Despite the adoption of secrets managers, secrets still leak. Hardcoded passwords, encryption keys, API keys, and other secrets continue to appear in source code, Git histories, CI/CD pipelines, log files, etc.—and breaches keep occurring. This post explores why vault-only solutions fall short and how to implement end-to-end secrets hygiene with integrated secrets detection, revocation, and developer-friendly workflows.

Notable Security Incidents Caused by Exposed Secrets

There have been several recent notable cybersecurity incidents where exposed secrets played a central role—impacting everything from AI systems to private user data:

• xAI API key exposed on GitHub: A federal government software developer inadvertently published a sensitive API key in a public GitHub script (agent.py). This key granted access to 52 private large language models, including the advanced Grok‑4 used by Elon Musk’s xAI initiative and federal contracts. The exposure posed serious national security risks, especially given the developer’s high-level access to government systems. As of reporting, the key remained active with no revocation notice issued from xAI.
• 16 billion credentials leaked by Infostealers: Cybernews uncovered a massive trove of 16 billion login credentials—from platforms like Apple, Google, Facebook, GitHub, and government services—leaked via multiple infostealer malware and unsecured cloud repositories. While not a breach at any single company, the scale and freshness of this exposure are unprecedented, supplying threat actors with a potent arsenal for phishing, account takeover, and credential stuffing campaigns.
• Underground forum Leak Zone exposed its own users: Ironically, Leak Zone—a prolific cybercrime forum—is believed to have left its own user data exposed in an unprotected Elasticsearch database. Researchers found over 22 million records, including IP addresses, login timestamps, and indications of whether users were using VPNs or proxies. Up to 100,000 member accounts may have been compromised.
• Tea app data breach compromised sensitive photos and messages: The Tea app, marketed as a “women’s safe space,” suffered a devastating breach. Over 72,000 images, including selfies and IDs, were leaked publicly due to an unsecured backend. A second breach exposed 1.1 million private messages, filled with deeply personal information (e.g., abortion discussions, infidelity mentions, phone numbers, and locations). The fallout has led to at least 10 class-action lawsuits, highlighting failure to protect biometric and personal data.

These incidents highlight a troubling reality: secrets continue to be compromised not just through sophisticated hacks, but via simple misconfigurations, developer practices, and inadequate secrets hygiene.

Why Secrets Still Leak—Even with Vaults

Vaults are powerful, but they operate under the flawed assumption that developers and automation will use them correctly 100% of the time. According to GitGuardian’s 2025 State of Secrets Sprawl report, there was a 25% increase in new secrets detected in public GitHub commits last year and 35% of all private repositories contained hardcoded secrets. Vaults alone didn’t prevent those exposures.

Here’s what actually happens to secrets in most orgs:

• Hardcoded in source code: Developers often copy secrets from vaults into local .env files or hardcode them temporarily for testing. These secrets can accidentally be committed to Git repositories, left in shared dev environments, or compiled into applications. Even if secrets are later deleted from the source code or configuration files, it can be too late because they often remain in commit histories.
• Exposed in CI/CD pipelines: CI/CD tools frequently echo environment variables in logs, cache secrets in build artifacts, and run insecure scripts that print or misuse secrets. Unless the pipeline is carefully hardened, it becomes a leak vector.
• Shared outside of secure channels: Secrets can be shared over Slack, email, or shared documents; passed manually between teams without expiration; or copied into tickets or wiki pages. Vaults only solve one part of the secrets management lifecycle: secure storage. They cannot prevent these kinds of user behaviors.
• Stored but not rotated or revoked: If secrets aren’t rotated regularly, scoped with least privilege, or set to expire after use, they become long-lived vulnerabilities that attackers can exploit if leaked. That same GitGuardian report found that 70% of valid secrets detected in public repositories in 2022 remain active today.
• Misconfigured or underused: Even with vaults available, developers might use them inconsistently, some services may bypass the vault entirely, and misconfigurations can expose vault endpoints or over-permissive access.
• Lack of secrets detection tools: Vaults don’t scan your environment for the presence of secrets. If you push a secret to GitHub, leave a key in a Slack message, or echo credentials in a log, you may never know because most vaults lack detection and alerting functions.

The Limitations of Vault-Only Approaches

Secrets managers help reduce exposure, but they don’t close the loop on secrets hygiene. There are four main reasons why:

1. No detection or prevention outside the vault: Vaults don’t alert you if someone hardcodes a secret or pushes a key to a public repo. You need a dedicated secrets scanner to continuously monitor codebases, logs, and container images.
2. Lack of integrated revocation procedures: Even when an exposed secret is detected, rotating that secret manually can take hours. Secrets should be automatically revoked and rotated when leaked—something most vaults don’t natively support.
3. Developer experience is an afterthought: Complex CLI tooling, inconsistent SDKs, and limited debugging support drive developers away from using vaults correctly. If secrets tooling disrupts their workflow too much, they’ll find workarounds.
4. Poor coverage of machine-to-machine secrets: Machine-to-machine (M2M) secrets like service account keys, API tokens, and certificates are often long-lived and unmanaged. Vaults store them—but they don’t track usage patterns or enforce least privilege by default.

What a Modern Secrets Management Strategy Looks Like

So, now that we understand the limitations of vaults and some of the leading causes of secret leakage, how should security teams respond? The answer is not eliminating vaults entirely. After all, vaults are a critical component of secrets management. However, they must be part of a broader ecosystem that includes:

1. Secrets Detection

• Implement continuous scanning in local source code, code repos, configuration files, CI/CD pipelines, and logs.
• Use secrets detection tools for real-time alerts. Checkmarx can accurately identify 170+ different types of login credentials, access tokens, encryption keys, API keys, SSH keys, webhook URLs, and other unsecured sensitive information.
• Catch secrets before they’re merged or deployed. Checkmarx Secret Detection automatically blocks code commits containing hardcoded secrets to prevent sensitive credentials from reaching Git repositories.

2. Secrets Revocation and Rotation

• Integrate auto-rotation with your vault.
• Use policies that trigger secret revocation when exposed secrets are detected.
• Eliminate static secrets by replacing them with short-lived tokens.

3. Developer-First Experience

• Use open-source SDKs and plugins that make secrets fetching seamless.
• Provide easy local development workflows (e.g., developer mode or sandbox secrets). With Checkmarx, developers can initiate scans for exposed secrets, review results, and receive remediation guidance within their integrated development environment (IDE). Scans can also be initiated via CLI, API, and the Checkmarx One UI.
• Educate devs on what to do for secrets management with docs and tooling.

4. CI/CD Pipeline Integration

• Treat your pipeline as a first-class actor in secrets access control.
• Set up ephemeral secrets that expire after job execution.
• Scan CI/CD artifacts for residual secrets.

How to Implement End-to-End Secrets Hygiene 

To build a modern secrets management strategy, you need to move beyond just storing secrets in a vault. You need to operationalize secrets hygiene across the full development lifecycle—detecting exposures, quickly revoking compromised credentials, and enabling developers to use secrets securely without friction. Here’s how:

1. Foundation: Use a Vault, But Use It Correctly

A secrets manager or secrets vault should still be your single source of truth for all secrets.

Best practices:

• Centralize secrets within a trusted vault or secrets manager.
• Use least-privilege access controls and integrate with IAM.
• Encrypt secrets at rest and in transit.
• Prefer dynamic secrets (short-lived tokens) over static ones, when possible.

2. Integrate Secrets Detection at Every Stage

Secrets scanning must be continuous, automated, and shift-left. Use detection tools to catch what vaults miss, like accidental commits, exposed logs, or insecure sharing.

Implement:

• Pre-commit hooks to stop secrets before they enter version control.
• Pull-request scanning into your CI/CD platform.
• Periodic scans of your entire codebase, container images, and infrastructure as code (IaC).
• Monitoring for leaked secrets in public repositories and developer sandboxes.

3. Automate Secrets Revocation and Rotation

When a secret leaks, you need fast, automatic revocation—not manual ticketing and delays.

How:

• Use vault tooling that supports automatic revocation and regeneration of secrets.
• Integrate detection tools with your vault or security orchestration tools to trigger revocation workflows.
• Set expiration policies for secrets (e.g., TTLs for service tokens).
• Track secret usage and alert on anomalies (e.g., unused secrets, off-hours access).

4. Make It Developer-Friendly

If using your secrets management stack is painful, developers will circumvent it. Good secrets hygiene should feel like a help, not a burden.

Design for DevEx:

• Provide easy local development integrations (e.g., sandbox secrets or IDE plugins).
• Use unified SDKs or APIs to fetch secrets securely across languages and environments.
• Make secrets injection seamless in pipelines and containers (e.g., using sidecars or environment variable injection).
• Offer training and documentation on how to avoid secret sprawl.

5. Harden Your CI/CD Pipelines

Pipelines are a common blind spot—and a common source of leaks.

Secure the pipeline:

• Scan builds and logs for secrets with a secret scanner.
• Inject secrets at runtime using vault integrations (not static config files).
• Revoke and rotate pipeline secrets after every job.
• Use ephemeral credentials for short-lived jobs.

6. Monitor and Audit Everything

Visibility is key to ongoing security.

Add observability:

• Log every access to secrets and generate audit trails.
• Monitor for anomalies in secrets usage patterns.
• Track who accessed what, when, and where.
• Integrate secrets alerts into your SIEM or SOAR platform.

When used in tandem, integrated secrets detection, revocation, and developer-friendly practices create an end-to-end secrets hygiene model that provides a comprehensive, proactive approach to managing secrets across their entire lifecycle—from creation and storage to detection, revocation, and eventual retirement. Unlike vault-only solutions, which focus narrowly on storage, end-to-end hygiene minimizes the risk of leaks, speeds up incident response, and empowers developers to handle secrets securely by default. 

Bottom line? End-to-end secrets hygiene doesn’t just reduce breach risk—it builds resilience, enhances developer workflows, and positions your team to scale securely.

Checkmarx One delivers a full suite of enterprise AppSec solutions in a unified, cloud-based platform that allows enterprises to secure their applications from the first line of code to deployment in the cloud. Our Secrets Detection solution protects against accidental secrets exposure by accurately detecting and validating hardcoded secrets to reduce attack surfaces and minimize risk. We’re able to identify over 170 types of sensitive information, from API keys to passwords, and our automated pre-commit prevention stops secrets from ever reaching code repositories. And we scan historical Git commits to find any secrets already there. With live secrets validation to prioritize remediation efforts and seamless integration with IDEs and developer workflows, Checkmarx is your solution for successful end-to-end secrets hygiene.