# Developer secrets management that keeps delivery moving

DevFeed: [Developer secrets management that keeps delivery moving](<https://devfeed.tech/articles/developer-secrets-management-that-keeps-delivery-moving-1915.md>)

Original publisher: [Read original article](<https://1password.com/blog/developer-secrets-management-that-keeps-delivery-moving>)

Author: info@1password.com (Robert Imeson)

Published: 2026-08-17T00:00:00Z

Content type: article

Language: en

Sources: [Blog on 1Password Blog](<https://devfeed.tech/sources/blog-on-1password-blog.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [API keys](<https://devfeed.tech/topics/api-keys.md>), [Software Engineering](<https://devfeed.tech/topics/software-engineering.md>), [OpenSSH](<https://devfeed.tech/topics/openssh.md>), [Database](<https://devfeed.tech/topics/database.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [api-keys](<https://devfeed.tech/tags/api-keys.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [code](<https://devfeed.tech/tags/code.md>), [developer](<https://devfeed.tech/tags/developer.md>), [developers](<https://devfeed.tech/tags/developers.md>), [development](<https://devfeed.tech/tags/development.md>), [github](<https://devfeed.tech/tags/github.md>), [incident](<https://devfeed.tech/tags/incident.md>), [logs](<https://devfeed.tech/tags/logs.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [security](<https://devfeed.tech/tags/security.md>), [software](<https://devfeed.tech/tags/software.md>), [software-development](<https://devfeed.tech/tags/software-development.md>), [ssh](<https://devfeed.tech/tags/ssh.md>), [tokens](<https://devfeed.tech/tags/tokens.md>), [unified-access](<https://devfeed.tech/tags/unified-access.md>)

## AI overview

The article examines how unmanaged developer credentials--such as API keys, cloud credentials, SSH keys, and tokens--can remain outside approved security controls. It argues that secrets management must reduce workflow friction and address credentials at the point where developers create and use them, while enabling rotation, revocation, auditing, and reporting.

## Source excerpt

In March 2025, attackers compromised a GitHub Action used in the development pipelines of more than 23,000 repositories. The malicious code exposed API keys, cloud credentials, SSH keys, and other tokens in workflow logs. Affected teams were advised to review their workflow runs and rotate any credentials the logs exposed. Affected organizations had to determine which credentials had been exposed, what those credentials could reach, and how to replace every one of them without halting development. Many could not confidently answer the first question alone. The incident illustrates the problem those responsible for a team's credentials face today: the credentials that carry the most risk are often the ones nobody is tracking. Security tools cannot govern credentials they never see Unmanaged credentials are simply a byproduct of the modern software development environment, where developers are under pressure to constantly ship code. A developer standing up an application needs a database password or an API key immediately, and the fastest way to supply one is a .env file on the local machine, an SSH key in a home directory, or a token pasted into a pipeline variable. Each choice keeps work moving, and each one creates a working credential that exists outside any approved system, where no one responsible for keeping projects, credentials, and access safe can rotate, revoke, or audit it. Traditional secrets management can leave this gap open because it starts on the wrong side of it. Conventional tools provide a secure destination but depend on developers to bring credentials to it, so governance begins only after migration. When a security process adds friction, teams find workarounds. 1Password's research found that 43% of developers don't use a dedicated secrets manager or vault at all, managing secrets through a mix of secure and unsecure means instead. As a result, credentials remain outside the controls, reporting, and rotation processes intended to protect them.