A secret leaks into public code every two seconds and manual revocation takes about 40 days. Check the API keys in your automations

Every automation is a bundle of credentials. GitHub's new numbers say the cleanup side is where things break.

What happened

GitHub published nine quarters of secret scanning data. A new secret appears in publicly visible code about once every two seconds, a number that has doubled yearly for three years. One in three pull requests on GitHub now involves an AI agent, up from fewer than one in ten a year ago.

GitHub argues developers are not getting more careless. Between Q2 2024 and Q2 2026, screened pushes grew 2.84 times while pushes carrying credentials grew 2.59 times, with no detectable trend in the per push rate. The share of push blocks developers overrode fell from 6.63% to 3.93%.

The problem is volume. The mean time to manually revoke a leaked secret hovers around 40 days, and roughly one in five took more than 90 days. Push protection stops about 30% of newly detected secrets before they enter history. The rest are found after they are already exposed. GitHub's line: prevention scales with compute, but remediation still scales with people.

GitHub built a ModernBERT classifier with Microsoft Applied Sciences that judges candidate secrets in context in under two milliseconds, aimed at unstructured secrets like database passwords. GitHub says it could more than double the secrets it prevents. It comes to push protection for Secret Protection customers later this month, consuming AI credits, and is being added to the Copilot CLI security review command.

My take

People building automations handle more credentials than most developers. A single client setup can hold CRM keys, email provider keys, webhook URLs, an OpenAI key and a database password. Those end up in exported workflow JSON, in code nodes, in shared Google Sheets and now in agent generated scripts.

The 40 day number is the one to sit with. If a key leaks, the damage window is how long it takes you to notice and rotate it. A checklist I use:

• Keep keys in the platform's credential store, never pasted into nodes or sheets.
• Strip credentials before exporting or sharing workflow files. If workflows live in a GitHub repo, turn on push protection: GitHub's docs say repository level push protection is disabled by default.
• Give each client and each workflow its own key, so rotating one does not break everything.
• Keep a simple register of which key lives where and who can revoke it.
• Rehearse a rotation once. If it takes an afternoon, it will take weeks during an incident.