A security researcher just found a GitHub employee’s OAuth token that granted write access to GitHub’s own main repository. He found a Home Depot employee’s token with admin access to over 60 repositories. And he found nearly 9,000 other verified, live secrets sitting in the open.
None of them were in a Git repo.
They were in Cloud Development Environments. CodeSandbox, StackBlitz and CodePen. The browser-based tools your developers use every day to prototype, debug, and share code snippets.
Ben Zimmermann’s research, documented by Truffle Security, is one of the most important findings in secrets management this year. Not because the concept is new, but because it exposes a category of risk that most security programs are completely ignoring.
Enterprise Security for AI Agents & Non-Human Identities
Your Scanner Has a Blind Spot
Most secret scanning strategies start and end with Git. A developer pushes a key to a repo, the CI/CD pipeline catches it, and the credential gets rotated. That workflow is mature. It works.
But CDEs sit entirely outside of it.
These platforms are designed for speed. Spin up a sandbox, test something, share a link. Because they live in the browser and feel temporary, developers treat them like private scratchpads. They paste in API keys, database strings, and cloud credentials without thinking twice.
The problem: these environments are often public and searchable by default. And unlike GitHub, CDE platforms have almost no native protection or partner programs to automatically revoke leaked credentials.
Three Things You Should Be Worried About
The Ephemeral Fallacy. Just because a sandbox is easy to delete does not mean it is private while it exists. If a team is debugging an issue with live data or real API keys, that is a leak waiting to happen.
Full-stack platforms carry the biggest risk. Zimmermann’s research shows that platforms like CodeSandbox, which support full backend environments, produce the most severe leaks. We are talking database connection strings, cloud service accounts, and infrastructure credentials.
CDE usage is shadow IT. Most companies do not have a formal policy for tools like CodePen or JSFiddle. They are not provisioned, not monitored, and not included in security audits. But developers are using them every day.
Where Entro Fits
Traditional secret scanning is reactive. It watches your known repositories and catches what gets pushed there. But the whole point of Zimmermann’s research is that secrets are leaking into places you are not watching.
This is the problem Entro was built to solve.
Entro monitors the full lifecycle of your secrets and identifies where they are actually being used, not just where they were created. When a production key migrates into an unauthorized environment like a CDE, Entro surfaces the risk with full context: who created it, what it has access to, and how to remediate it.
That visibility gap between “we scanned our repos” and “we actually know where our secrets live” is exactly where breaches happen.
The Bottom Line
Credential leakage is not a solved problem. It is an evolving one. As developer tooling gets faster and more distributed, the attack surface grows with it.
The organizations that stay ahead will be the ones that stop treating secret scanning as a Git-only workflow and start thinking about secrets as assets that move across their entire ecosystem.
Entro gives you that visibility. So your developers can keep moving fast without leaving production keys in a public sandbox.
