Secret Sprawl Detection

Secret sprawl detection maps where each secret is consumed across your infrastructure -- which applications, services, and pipelines reference it. The analysis identifies duplicated credentials (the same value stored under different names), unused secrets (no read access in N days), and over-shared access (secrets readable by more users than necessary).

Each secret receives a sprawl risk score based on duplication count, access breadth, and staleness. The dashboard prioritizes secrets by sprawl score to guide consolidation and cleanup efforts.

Key Configuration

• Staleness threshold (days since last read)
• Duplication detection sensitivity
• Over-sharing threshold (max readers per secret)
• Sprawl score weights