Secrets sprawl. Copies spread. Rotation does not.
A secret is created once and copied many times. Rotation happens in one place. That asymmetry is the whole of secrets sprawl, and agents make the copying faster without changing the rotation.
- A secret is created once and copied many times. Each copy works, and only one of them gets rotated.
- Agents accelerate the copying: anything running in the same shell, container or job can read what is there.
- The dangerous copy is usually not where the secret is used but where it was pasted while something was being debugged.
- When you cannot rotate everything, rotate by what the credential reaches, not by where it was found.
Published Last reviewed
Five places secrets end up.
Only the first two appear in most secret scanning. The last three are where the copies that matter usually live.
A .env created for local work, committed once and removed in a later commit. The working tree is clean and the history is not, which is why history scanning finds things that file scanning does not.
A secret added for a pipeline that no longer exists, still available to every job in the project. Nothing fails when it is unused, so nothing draws attention to it.
Cloud profiles, SSH keys, tokens in shell history and in the config of tools installed to try something out. This is the set an agent on that machine can read, whether or not it was given them.
Pasted during an incident or an onboarding, then indexed and searchable forever by everyone with access to the workspace, including the AI tools connected to it.
Baked in during a build and present in every layer afterwards. Removing the line in a later layer does not remove it from the image.
Rotation order when you cannot do it all.
Not alphabetical, and not by where it was found. By what sits at the end of the credential.
| Credential | What it typically reaches | Rotation priority |
|---|---|---|
| Cloud key or profile | Whatever role it can assume, often production. | Critical |
| Deploy or publish token | The ability to ship code to users. | Critical |
| Database connection string | The data directly, usually with write access. | Critical |
| Source control token | Private code and the secrets inside it. | High |
| Model provider key | Spend, plus any agent sharing the same key. | High |
| Read-only SaaS key | One system, bounded. | Medium |
How to work it down. Four steps.
Step one changes what you find. Step two changes what it was worth finding.
A secret removed in a later commit is still in the repository. History scanning is the difference between finding the ones that embarrass you and the ones that are live.
A publish token makes you the delivery vehicle for the next attack, which is why it outranks credentials that only read.
Scoping an agent is undone by a broad token sitting in the same job. Look at everything readable from where the agent runs, not only at what it was granted.
Every rotation is an opportunity to replace a static secret with a short-lived one. If the platform cannot issue those for that system, record it as an accepted risk with an owner.
Questions, answered.
Short answers on secrets sprawl.
What is secrets sprawl?
The spread of credentials into more places than anyone tracks: configuration files, CI stores, developer machines, tickets, chat and build artefacts. The defining property is that every copy keeps working while rotation only ever touches one of them.
How do AI agents make it worse?
They do not create new secrets, they read existing ones faster and from more places. Anything running in the same shell, container or CI job as a credential can read it, so a coding agent inherits whatever is lying around next to it.
Where should rotation start?
With anything that can deploy, assume a role or reach data directly. Rotating alphabetically or by discovery order spends the disruption budget on credentials that reach a wiki while the one that reaches production waits.
Keep reading.
The pages that belong to the same picture.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.