Itwerx is a service-disabled veteran-owned managed IT and cybersecurity provider serving businesses in Seattle, Bellevue, Everett, Lynnwood and Snohomish County, founded in 2005, and works with clients who run development teams as well as individual developers who need the same discipline applied to their own accounts.
The real number
No published report supports the two-thirds figure that circulates for this, and it is worth saying so before repeating anything: the number traces to nothing. The figure that does exist is higher and older. In 2021, Dark Reading reported that 85% of leaked secrets occurred in developers’ personal repositories, with the remaining 15% affecting public repositories owned by businesses. A vendor product page also advertises an 80% figure, undated and without a published methodology – that is sales copy, not a measurement, and should not be cited as one.
Why it happens
Secrets end up in a developer’s personal account for one of two reasons: by accident, because the wrong account was used for a commit, or on purpose, because a developer keeps a personal copy of code for their own reference. Which reason applies in any given case does not actually matter, because the security exposure is identical either way, and the accounts where it happens are precisely the accounts corporate scanning tools do not cover.
What actually fixes it
The practical response is to stop treating secrets like static files: no more hardcoding credentials into source, no more keeping them in a separate file or folder that eventually gets copied somewhere it should not be, and no more relying on a time-based refresh as the only safeguard. A dedicated secrets manager, applied the same way a password manager is now assumed for personal accounts, closes the gap that corporate repo scanning cannot reach. Some consumer password manager vendors already offer this functionality directly, which makes it a far lower lift than it sounds. A development team can be excellent and still be made up of people, and the fix has to assume that rather than argue with it.
Itwerx Corp is a service-disabled veteran-owned small business providing IT services across Seattle, Bellevue, Everett and Snohomish County. This is the kind of thing our cybersecurity work deals with – talk to us about yours.
