September 2025 Summaries

The challenges of secrets management in software engineering, involving various types of credentials like API keys and SSH keys stored across diverse systems, have been simplified with GitGuardian NHI Governance, which acts as a central monitoring dashboard. This tool integrates with secrets managers, CI systems, and Cloud IAMs to provide a detailed view of Non-Human Identities (NHIs) used in machine-to-machine interactions. The integration with AWS IAM utilizes OIDC for authentication, offering secure and temporary credentials while adhering to the least privilege principle. By analyzing AWS IAM data and permissions, the system enhances security insights and provides a comprehensive overview of credential sensitivity and potential leak impacts. The setup process involves configuring an OIDC provider in AWS, creating policies and roles with precise permissions, and integrating with GitGuardian to populate the NHI inventory with data. This approach aims to improve security posture by centralizing the visibility and control of secrets across various platforms, minimizing the risk of secret leaks and enhancing security management.

OWASP AppSec Days France 2025 highlighted the intricate challenges and strategies in securing modern software delivery pipelines. Held in Paris, the event drew over 150 security practitioners, developers, and OWASP members who engaged in sessions addressing software supply chain vulnerabilities, the critical role of CI/CD as a new perimeter, and the potential of passkeys to replace traditional passwords. Keynote speakers like Roni Carta and François Proulx emphasized the importance of understanding the vulnerabilities in dependencies and CI pipelines, advocating for practices such as pinning exact versions, enforcing MFA, isolating caches, and treating pipelines like production systems. Daniel Garnier-Moiroux showcased the benefits of passkeys through live demonstrations, explaining how they can enhance security by tying key material to a domain and ensuring that credentials never leave local devices. Throughout the conference, the overarching message was the necessity of collaboration, communication, and adherence to best practices across teams to create a cohesive defense against security threats. The event underscored that effective security is not about isolated measures but about a shared culture of attention and coordination, akin to the organized rhythm of Parisian traffic in the absence of stop signs.

In 2025, application security is challenged by the rapid exploitation of exposed secrets and the slow pace of traditional remediation processes. GitGuardian introduces a one-click secret revocation feature that allows security teams to quickly invalidate exposed secrets directly from incident pages, addressing the critical gap between detection and response. This capability minimizes the attack window by enabling immediate action, complete with safeguards and audit trails to ensure compliance with standards like PCI DSS 4.0. The tool provides extensive context and insights to assess the impact of revocation, helping teams decide between immediate revocation and a coordinated response based on risk levels. Initial feedback from alpha testing shows significant adoption, with 40% of users immediately utilizing the feature upon receiving alerts. GitGuardian’s integration with providers like GitHub, GitLab, and OpenAI marks a step towards comprehensive secret management and automation, aiming to revolutionize incident response by reducing manual processes and enhancing collaboration within the security ecosystem.

In modern enterprises, the concept of ownership, particularly regarding non-human identities (NHIs), differs significantly from personal ownership, as it involves complex interactions across various teams. Instead of focusing on individual accountability, enterprises should emphasize risk management and governance by ensuring that critical questions about NHIs, such as their purpose, access permissions, and security status, are easily answerable. This approach minimizes risks and scales better than relying on human-dependent processes. GitGuardian's platform supports this by integrating secrets detection with governance, providing actionable insights and continuous monitoring to enhance security and compliance. By shifting the focus from blame to assurance, GitGuardian helps organizations maintain control over NHIs, aligning with frameworks like OWASP's Top 10 for NHI risks to address issues such as long-lived secrets and leaked credentials.

Sensitive information exposure in CI/CD pipelines is a critical security risk that is often overlooked, particularly in build logs that can contain environment variables, API keys, and other credentials. Traditional secrets scanning usually targets source code, but modern DevOps processes create multiple exposure points, such as deployment scripts and application logs. The blog post introduces GitGuardian's "Bring Your Own Source" initiative, which automates the scanning of GitLab CI pipeline logs for secrets using ggshield. This approach captures and analyzes logs from all jobs in real-time, creating incidents in the GitGuardian dashboard when secrets are detected, thereby providing comprehensive secrets detection across the entire DevOps lifecycle without disrupting existing workflows. The implementation helps organizations maintain compliance, enhance security, and improve developer practices by providing audit trails and real-time alerts, addressing gaps that traditional secret scanning methods might miss.

A recent supply chain attack, identified on September 15, targeted the @ctrl/tinycolor and 150 other NPM packages, using a method similar to previous campaigns like s1ngularity and GhostActions. The attackers extracted local environment secrets and injected malicious GitHub Actions workflows into accessible projects, with the compromised packages detailed by socket.dev and StepSecurity. GitGuardian's research team investigated the attack to assess its impact on leaked secrets, offering the HasMySecretLeaked service for developers to check if their credentials were compromised. The attack, known as Shai-Hulud, involved collecting secrets from victims' local machines, encoding them, and uploading to GitHub, with malicious workflows pushing further compromises. Despite a quick response that limited the attack and revoked many leaked secrets, some credentials remain valid, posing ongoing risks. The campaign's worm-like propagation suggests it may persist, highlighting the evolving threat and need for vigilance in the open-source ecosystem. GitGuardian continues to monitor these threats in real-time, providing tools to detect and mitigate such security challenges.

GitGuardian uncovered the GhostAction campaign, a large-scale supply chain attack that compromised 327 GitHub user accounts to inject malicious workflows and steal 3,325 secrets from CI/CD environments across 817 repositories. The attackers disguised the workflows as "Github Actions Security" and extracted sensitive credentials, such as PyPI tokens, npm tokens, DockerHub credentials, GitHub tokens, and AWS access keys, via HTTP POST requests to a controlled endpoint. Despite the breach, no malicious packages were published using the stolen credentials, but 24 packages remain at immediate risk of compromise. GitGuardian's swift response involved alerting affected users, collaborating with GitHub, npm, and PyPI security teams, and maintaining surveillance to prevent further exploitation. Developers are advised to audit repository access, monitor for unauthorized changes, and implement additional security measures to protect against similar attacks.

The Salesloft Drift breach exposed the vulnerability of enterprise systems to sophisticated credential-harvesting attacks, impacting numerous major organizations and highlighting the necessity for advanced secrets detection beyond traditional code repositories. Mandiant's investigation revealed that attackers had accessed Salesloft's GitHub account months before launching a targeted campaign, enabling extensive reconnaissance and mapping of integration architectures. The breach affected over a dozen cybersecurity firms and involved the theft of sensitive credentials like AWS access keys. This incident underscores the urgent need for comprehensive security strategies, including the implementation of a Salesforce secrets scanning pipeline using tools like the Salesforce CLI and GitGuardian's ggshield scanner. This pipeline facilitates the detection and management of hardcoded secrets across Salesforce data, integrating with GitGuardian's platform to provide centralized incident management and actionable intelligence, thereby strengthening the overall security posture against sophisticated cyber threats.