Secret sprawl
Secret sprawl is the uncontrolled distribution and duplication of secrets across systems, code, teams, and environments.
Definition
Secret sprawl describes the situation in which passwords, keys, tokens, or connection secrets are stored in too many locations and handled by too many components without central governance. It increases the attack surface and makes inventory, rotation, and incident response more difficult. Secret sprawl is itself an IAM and security anti-pattern: duplicated passwords, keys, tokens and service credentials spread across technical and organizational locations enlarge the attack surface, degrade inventory quality, complicate rotation and slow incident response.
Why it matters
Secret sprawl silently multiplies the number of paths an attacker can use, and it makes rotation, revocation and incident response far harder than the organisation expects.
The Ariovis perspective
Secrets must be treated as governed assets with ownership, controlled storage, rotation and revocation. Moving a static secret into a vault is useful, but it does not solve excessive privilege or a missing lifecycle.
Related services
Common pitfalls
- A frequent mistake is moving secrets into a vault without removing the copies already scattered across code repositories, scripts, pipelines and configuration files.
Explore this category
These concepts matter most inside a real project.
The first conversation helps establish your context, the systems involved and the next useful decision.