Records / Negotiation levers

Internal code holds hardcoded secrets about six times as often as public code, so a codebase must be scanned and its credentials revoked before a buyer sees it

GitGuardian's State of Secrets Sprawl 2026 (5th edition, March 2026) finds that 32.2% of internal repositories contain at least one hardcoded secret against 5.6% of public repositories, and states that internal repos are 6 times more likely to contain them. Its 2025 edition put it at 35% of its customers' private repositories and 9 times public ones. Private code is what Google's Content Offer Pilot, Scale's SWE-Bench Pro commercial set and the other code buyers pay for, so on these figures about one internal repository in three offered for sale would carry a hardcoded credential somewhere in it.

Dated 17 Mar 2026Source checked 27 Oct 2026Quote found on its page again 4 Nov 2026Basis: strong

Selling a company's data? The guide beside the button shows what this record means for a sale.

Value your dataGoogle Content Offer Pilot: What It Buys and Pays
  • No data upload
  • About two minutes
  • No email needed
In the source's own words
“Internal repos are 6× more likely than public ones to contain hardcoded secrets.”
Figures it counts in

It is shown on its own, not counted into a figure.

Internal code holds hardcoded secrets about six times as often as public code, so a…