This episode is made possible by GitGuardian. Jeff speaks with Dwayne McDaniel, Principal Developer Advocate at GitGuardian, about secrets sprawl, non-human identity governance, and the findings of the State of Secret Sprawl 2026 report. With 28.6 million secrets leaked to public GitHub in 2025 - a 34% year-over-year increase - they explore why hardcoded credentials persist, how agentic AI tools are making the problem worse, and what IAM practitioners can do to start addressing machine identity governance. Topics include GitGuardian's Good Samaritan notification program, the growing NHI inventory challenge, SPIFFE and SPIRE as a path to zero standing privilege, and data showing Claude Code co-authored commits are more than twice as likely to contain leaked secrets. Visit gitguardian.com/lps/idac to learn more.
Connect with Dwayne: https://www.linkedin.com/in/dwaynemcdaniel/
Dwayne's website: https://dwayne-mcdaniel.com/
Learn more about GitGuardian: https://www.gitguardian.com/lps/idac
GitGuardian Good Samaritan Program (free) - https://www.gitguardian.com/good-samaritan
The State of Secrets Sprawl 2026: https://www.gitguardian.com/state-of-secrets-sprawl-report-2026
SPIFFE Book: https://spiffe.io/book/
Connect with us on LinkedIn:
Jim McDonald: https://www.linkedin.com/in/jimmcdonaldpmp/
Jeff Steadman: https://www.linkedin.com/in/jeffsteadman/
Visit the show on the web at http://idacpodcast.com
TIMESTAMPS:
00:00 Introduction and sponsor welcome
00:48 Dwayne's background and path to developer advocacy
04:11 Surprises from entering the identity and security space
06:29 What a principal developer advocate actually does
09:32 Why secrets became Dwayne's focus area
14:10 GitGuardian: overview and mission
19:36 Where secrets commonly leak across the SDLC
22:17 The Good Samaritan notification program explained
28:00 Why 70% of leaked secrets from 2022 were still valid in 2025
33:54 State of Secret Sprawl 2026: the year software changed
40:39 AI coding tools, Claude Code, and secrets leakage data
47:28 Practical questions for IAM practitioners to start asking
52:24 Zero standing privilege and the case for SPIFFE/SPIRE
01:00:00 Resources: the SPIFFE book, WIMSE, and AWS STS
01:02:51 Hot sauce, the Cubs, and closing thoughts
KEYWORDS:
secrets sprawl, hardcoded secrets, non-human identity, NHI governance, GitGuardian, SPIFFE, SPIRE, workload identity, DevSecOps, agentic AI, Claude Code, zero standing privilege, supply chain security, credential abuse, identity and access management, IAM, IDAC, Identity at the Center, Jeff Steadman, Jim McDonald, Dwayne McDaniel
51:49