What is secrets exfiltration?
Secrets exfiltration is the unauthorized removal of credentials, tokens, or keys from a repo, CI log, container layer, or deleted GitHub fork. IBM 2025 average: $4.44 million.
Read guideWeb Security
Sensitive data & secrets guides
How secrets leave the process, why environment variables are a weak store, and how to redact sensitive fields in logs.
What these guides cover
Sensitive data and secrets are values that grant access or identify a person: API keys, tokens, passwords, card numbers, and government IDs. Exfiltration is the movement of those values out of the intended boundary – into a log, a ticket, a model prompt, or an attacker-controlled host. Environment variables are convenient for local development and a poor production store: they are inherited by every child process, dumped in crash reports, and visible to every library in the process. Detection and redaction belong in the request path and in the logger, not only in a post-incident search.
Risks
- Secrets copied into logs, tickets, and model prompts
- Production credentials stored in environment variables
- Structured logs that serialize password and token fields
- PII leaving the process to a third-party scanner
Control priorities
- In-process sensitive-info detection before persist or provider
- A secrets manager with short-lived, runtime-injected credentials
- Logger redaction via typed values, not string search after the fact
- Least-privilege tokens and rotation after any suspected leak
Recommended reading order
Start with secrets exfiltration for the threat model. Use the environment-variable guide when the store is the problem, and the log-redaction guide when the leak path is observability.
Guides in this collection
Should you store secrets in environment variables?
Avoid environment variables for production secrets. They are plaintext, easy to dump, and have no audit trail (CWE-526). Store an ID in the env and fetch at runtime.
Read guideHow do you redact sensitive data from Go logs?
Implement slog.LogValuer on types that hold secrets so only allow-listed fields are logged. log/slog has been in the standard library since Go 1.21.
Read guidePII detection for AI applications
PII detection for AI applications finds personal data in prompts, model replies, tool calls, and logs, and acts on it in your process before it reaches a provider.
Read guide