Most application security programs assume a clean boundary. Your code lives in your organization's repositories, your identity provider governs who touches it, and controls like branch protections and secret scanning are applied inside that boundary.
The reality is that developers don’t work that way.
The same engineer who pushes to code to a GitHub Enterprise organization by day maintains side projects, forks, and experiments under a personal account by night. These are often the same GitHub account, toggling between an org context you control and a personal one you don't. When corporate code or a credential gets copied into a personal public repo, usually by accident and in a hurry, it creates a blindspot for risk, one larger than most teams realize.
Wiz Research found verified secret leaks in 65% of the Forbes AI 50, and 56% of company-impacting secrets lived in employees' personal repositories, where most security programs have no visibility.
Closing this gap is what Wiz does by correlating your developers with the personal public repositories they own, validating which exposed secrets are actually exploitable, and driving them to a tracked fix. In this post, we'll explain why this problem is accelerating, why traditional secret scanning can't solve it, and how identity-driven correlation changes the way AppSec teams manage secret exposure.
The Threat Landscape: Why Attackers Target Public Repos
Threat actors perform automated reconnaissance using bots that monitor public commits on GitHub in near real time. When a secret appears in a public repo, it can be picked up in minutes, sometimes seconds, and used immediately.
But raw exposure volume understates the danger, because not every leaked string is a live risk. What matters is which secrets are validated—confirmed active and usable at the time of discovery.
In our State of SDLC 2026 report, we found validated secrets found in public repositories frequently provide infrastructure-level access rather than application-only access: cloud provider credentials, CI/CD tokens, third-party API keys, and AI service credentials. In other words, a leaked key of this kind isn't a door into one app, it's a door into the infrastructure behind it.
Two forces are accelerating this risk.
AI-assisted development: AI increases code volume, reuse, and automated change propagation, which lets existing secrets spread faster and farther across development environments than teams can review them.
Novel risk from newer AI platforms: These platforms are young, but their credentials already leak at a rate disproportionate to the ecosystem's age—four of the top five most frequently leaked validated secrets are for AI services, because coding assistants optimize for velocity and velocity is where security review gets skipped.
Why Scanning Alone Doesn't Close the Gap
While traditional approaches to Secret Scanning are a good baseline form of defense, it doesn’t address the two things that make personal-repo exposure dangerous.
Secret scanning doesn’t see outside enterprise boundaries: As we’ve discussed, personal repositories are an invisible risk for organizations. A developer's personal public repo isn't org-owned, so it never enters inventory. You can't scan an asset you don't know exists.
Detected secrets don’t always map to exploitable attack paths: A detector produces a string match, not a risk. Is the secret still valid? Does it grant access to anything real? Knowing a secret is present is not the same as knowing it is live, and knowing it is live is not the same as knowing what it can reach.
The challenge isn't finding more secrets. Personal repository scanning often uncovers plenty. The challenge is knowing which ones actually matter. Without context, thousands of exposed secrets become just another backlog. By connecting exposed secrets back to your organization and enriching them with cloud, identity, and runtime context, security teams can prioritize the exposures that represent real risk and focus on the attack paths that matter most.
How Wiz Secures Personal Repositories
Closing the gap requires connecting three things that normally live apart: the developer identity, the repositories that identity touches inside and outside your org, and the our resources a leaked credential could reach. The unit of risk isn't the secret in isolation, it's the path from a specific person, to a specific exposed credential, to a specific asset that credential unlocks.
Automated inventory and correlation: When Wiz connects to GitHub, it inventories the developer accounts, then maps the personal public repositories those identities own. The order matters. You start from who, then discover what they've exposed, which is precisely the correlation org-scoped tooling can't make.
Map the attack path: Like other findings in the Wiz platform, secrets detected in a developers personal repository are enriched on the Wiz Security Graph so security teams can see the full attack path and blast radius of a compromised credential.
Exploitability validation: A detected secret is a hypothesis. Wiz's Red Agent tests it, confirming whether an exposed credential is active and what it can actually reach. This approach goes beyond traditional validity checks by using an AI powered attacker to try to exploit the secret the way a threat actor would. The benefit is that security teams can ruthlessly prioritize exploitable risks.
Rotate at Machine Speed
Finding the path is the beginning. Closing it is the point, and closing it is a race against the same bots scanning every public commit. Remediation has to move at automation's speed.
That's possible because Wiz ties every leak back to the exact commit, the GitHub user, and the email that pushed it. The finding arrives with its owner already attached—no SIEM archaeology to work out who pushed what. From there, security teams trigger the workflows they already run: open a Jira ticket, notify the developer in Slack, kick off rotation and revocation. Every step is tracked, so a secret is verified and fixed rather than merely acknowledged.
Identity-attached context is what turns a high-urgency finding into a fast, accountable fix. The path from this is exposed to this is handled is short, and it's auditable.
Modern Development Requires Modern Security
Development velocity isn’t slowing down, and personal accounts aren’t going away. As developers move fluidly between organizational and personal environments, especially with AI accelerating how much code is created and shared, security teams need visibility beyond the boundaries they control.
The challenge isn’t just finding more secrets. It’s understanding which exposures matter, who owns them, and what they put at risk.
Wiz Code closes this gap by bringing secrets, developer identities, repositories, and cloud context together in one security model. Secret scanning becomes one enforcement point across the development lifecycle, from the IDE and pre-commit hooks to pull requests, CI/CD pipelines, and personal public repositories. Each finding is enriched through the Wiz Security Graph, connecting exposed credentials to the identity behind them and the resources they can access.
The result is a shift from reactive secret detection to proactive exposure management. Instead of chasing isolated strings, security teams can prioritize the secrets that create real risk, assign ownership, and drive remediation through the workflows they already use.
Automating DISA STIG Compliance for Amazon Linux 2023 and Windows Server 2025, giving defense and federal teams immediate and continuous hardening validation.
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management