This episode is made possible by GitGuardian. Jeff speaks with Dwayne McDaniel, Principal Developer Advocate at GitGuardian, about secrets sprawl, non-human identity governance, and the findings of the State of Secret Sprawl 2026 report. With 28.6 million secrets leaked to public GitHub in 2025 - a 34% year-over-year increase - they explore why hardcoded credentials persist, how agentic AI tools are making the problem worse, and what IAM practitioners can do to start addressing machine identity governance. Topics include GitGuardian's Good Samaritan notification program, the growing NHI inventory challenge, SPIFFE and SPIRE as a path to zero standing privilege, and data showing Claude Code co-authored commits are more than twice as likely to contain leaked secrets. Visit gitguardian.com/lps/idac to learn more.

Connect with Dwayne: https://www.linkedin.com/in/dwaynemcdaniel/

Dwayne's website: https://dwayne-mcdaniel.com/

Learn more about GitGuardian: https://www.gitguardian.com/lps/idac

GitGuardian Good Samaritan Program (free) - https://www.gitguardian.com/good-samaritan

The State of Secrets Sprawl 2026: https://www.gitguardian.com/state-of-secrets-sprawl-report-2026

SPIFFE Book: https://spiffe.io/book/

Connect with us on LinkedIn:

Jim McDonald: https://www.linkedin.com/in/jimmcdonaldpmp/

Jeff Steadman: https://www.linkedin.com/in/jeffsteadman/

Visit the show on the web at http://idacpodcast.com

TIMESTAMPS:

00:00 Introduction and sponsor welcome

00:48 Dwayne's background and path to developer advocacy

04:11 Surprises from entering the identity and security space

06:29 What a principal developer advocate actually does

09:32 Why secrets became Dwayne's focus area

14:10 GitGuardian: overview and mission

19:36 Where secrets commonly leak across the SDLC

22:17 The Good Samaritan notification program explained

28:00 Why 70% of leaked secrets from 2022 were still valid in 2025

33:54 State of Secret Sprawl 2026: the year software changed

40:39 AI coding tools, Claude Code, and secrets leakage data

47:28 Practical questions for IAM practitioners to start asking

52:24 Zero standing privilege and the case for SPIFFE/SPIRE

01:00:00 Resources: the SPIFFE book, WIMSE, and AWS STS

01:02:51 Hot sauce, the Cubs, and closing thoughts

KEYWORDS:

secrets sprawl, hardcoded secrets, non-human identity, NHI governance, GitGuardian, SPIFFE, SPIRE, workload identity, DevSecOps, agentic AI, Claude Code, zero standing privilege, supply chain security, credential abuse, identity and access management, IAM, IDAC, Identity at the Center, Jeff Steadman, Jim McDonald, Dwayne McDaniel