64% of secrets leaked in public repos in 2022 still worked when GitGuardian retested in January 2026

Deleting a copy does not change a credential's validity. Rewrite the git history and purge the pipeline log, and the copy pasted into an incident ticket and the one in a teammate's local config still authenticate, because every copy carries the same privileges wherever the credential remains valid ^[3][11]. Invalidating the credential is one action; finding all the copies is many actions in many tools. GitGuardian's post puts the gap in one sentence: "Revocation needs cross-tool context nobody owns." ^[6]

The 64% describes a particular population: secrets that were found valid in public repositories in 2022 and retested in January 2026 ^[1]. Those are keys that leaked into public view and sat there for four years. For the figure to transfer to a managed estate, the credentials you have not found would have to behave like credentials whose owners never saw an alert at all. The post does not say how many were retested or how validity was checked ^[12].

GitGuardian's other figure counts incidents. Its State of Secrets Sprawl 2026 found that 28% of secrets incidents happen exclusively outside code repositories, in collaboration and productivity tools ^[2]. That leaves 72% touching a repository somewhere in the chain ^[10]. Repo scanning still sees most of the volume.

Boundary crossing also breaks the count in the queue. Three findings in three consoles might be three compromised credentials or one credential exposed in three places, and a control tied to a single telemetry source cannot establish which ^[5].

The detection layer stops helping the moment someone uses a copy. According to the post, "The login succeeds because it was built to succeed", and credential compromise "looks like legitimate access" ^[7]. Specialisation is why each layer works at all: a scanner that also tried to be an endpoint agent would do both jobs worse ^[13], and application security, EDR, IAM, vaults, cloud security and SIEM each do what they were built for ^[4]. In the post's own walkthrough the vault protected the copy enrolled in it. That copy was the safe one ^[14].

Coverage is the easy number to report, and it moves the wrong way as a program improves: point a scanner at the chat tool and open findings go up. In my view the two numbers to publish are the share of findings confirmed invalid and the median time from detection to invalidation. A secrets feature scoped to one surface can produce neither, because on its own it cannot establish everywhere else the credential exists or whether the exposure was fully remediated ^[8]. Both figures here come from GitGuardian, which published the post and the report they are drawn from ^[9].