Spotlight: How Secrets Sprawl Undermines Software Supply Chain Security

This transcript discusses the growing risk of "secret sprawl": developer credentials, API keys, certificates and other secrets accidentally committed to public and private source code repositories (notably GitHub). It explains how attackers rapidly harvest such secrets (sometimes within minutes), cites breaches enabled by leaked credentials, and outlines mitigation strategies including automated secret detection, pre-commit checks, repository history scanning, rotation of exposed keys, and centralized secret management.