What is secrets management?

Secrets management is the set of tools and rules a company uses to look after the credentials its own software relies on to talk to other systems: API keys, database passwords, access tokens, certificates, SSH keys. They are called secrets because whoever holds one can act on the application's behalf, no other proof required. Instead of living in source code, a configuration file or a chat message, they sit in a central encrypted store, the vault, which decides which program may read which secret, logs every read and replaces each one when it expires. The lifecycle (creation, distribution, rotation, revocation, audit) is the real substance of the discipline: guarding a key counts for little if nobody ever changes it. A leaked API key often does not expire on its own: it keeps working until someone revokes it, sometimes for years.

See also: Non-Human Identity (NHI) · A digital identity that belongs to software, not a person: service accounts, pipelines, bots and now AI agents acting on company systems.

Where the keys end up

According to State of Secrets Sprawl 2026 by GitGuardian, a security vendor reporting its own measurements, 28.65 million new secrets written in plain text were pushed in public GitHub commits in 2025, up 34% from the year before. GitHub itself counted more than 39 million secrets leaked across the platform in 2024, using its own criteria. Per GitGuardian, leaked AI-service secrets grew 81% in a year, a rise the report ties to the credentials every new tool, agent or integration brings with it. About 28% of incidents originate entirely outside repositories, in Slack, Jira and Confluence. Of the credentials found valid in 2022, more than 64% still worked when GitGuardian retested them in January 2026.

What a vault changes

The Secrets Management Cheat Sheet from OWASP, a nonprofit foundation, sets out the baseline practices: centralize storage, provisioning, auditing and rotation; give every program only the secrets it needs (least privilege); and automate. Automated rotation replaces static secrets at regular intervals; dynamic secrets go further, because the vault generates the credential on request and revokes it once it is no longer needed. NIST SP 800-57 defines the cryptoperiod as the time span during which a key is authorized for use. The next step is not storing the secret at all, with workload identity federation; governing the programs that use secrets is covered under non-human identities, while people's passwords belong in a password manager.

An enterprise example

On October 21, 2026, Railway, a cloud platform where developers deploy applications, disclosed that an attacker may have accessed, and partly decrypted, customers' encrypted environment variables, where many applications keep API keys and database passwords. Its preliminary report, published the next day, confirms decryption for a subset: early investigations indicate the attack was after AI provider keys, and at most 1.85% of workspaces (about 100,000) had variables potentially compromised. Railway asked the vendors involved to revoke the keys, and all of its customers to rotate theirs. The lesson, as I see it, is twofold: encryption protects a secret only as long as the key that opens it stays protected, and after an incident what counts is how fast every credential can be replaced.

Why it matters for decision makers

A leaked secret makes no noise: it works like a copied key. I would ask the team to account for three capabilities, not for the product. Inventory: do you know where your keys are, including chats and tickets? Rotation: how long does it take to replace a critical credential without taking the application down? Revocation and audit: after an incident, do you know which programs read which secret? Choose the vault with the exit in mind: OWASP recommends storing metadata for every secret, such as who created it, what it is for and when it must be rotated, to avoid being locked into a single vendor. The pipeline checks covered under DevSecOps stop keys before they reach the repository; the vault governs the rest.