The leaked key problem, by the numbers

Where the keys were

Most were not in public code. They were in places people thought were private.

• 41% in a private code repository that a contractor or old laptop still had access to.

• 27% in a shared document or a chat message, pasted "just for a minute".

• 19% in a public repository, most found by bots within six minutes of the push.

• 13% in build logs and error reports sent to outside tools.

How long they stayed valid

The median key had been in the wrong place for 94 days before it was used. Half of them belonged to people who no longer worked at the company.

A key is a password that never asks for a second step. Treat it like cash on a desk.

What to do this month

1. Find them. Scan your code and shared drives for keys. Hexwall does this for connected accounts every night.

2. Make them short lived. Keys that expire in hours instead of years turn most leaks into nothing.

3. Remove keys with their owners. When someone leaves, their keys leave the same day.

The full numbers, by cloud provider and team size, are in the Reports screen of the dashboard.