All IAM glossary termsPrivileged Access · glossary
Secrets sprawl
Also known as: Secret Sprawl · Credential Sprawl
Definition
Secrets sprawl is the uncontrolled proliferation of credentials — API keys, tokens, passwords, certificates — scattered across code repositories, CI/CD systems, config files, and developer machines without central management or rotation.
In more depth
It is the most visible symptom of ungoverned non-human identity. Leaked secrets in public + private repos are a leading breach vector; the fix is centralized secrets management (HashiCorp Vault, cloud secret managers) with rotation, plus secret scanning in CI and a move toward attested workload identity that needs no static secret at all.
Want the work, not just the definition?