Open Source Summit North America 2025

Leaked credentials aren't a new problem, but the primacy and complexity of Cloud environments means that leaked credentials are more likely than ever to be your problem. Not only that, but recent research has shown that it may only be a matter of seconds between a leak and an exploit. As the systems for developing, building, publishing and deploying applications become more sophisticated, the types of leaks developers need to guard against also change.

In this talk, we will present new research by the Google Open Source Security Team into when and how developers leak credentials in modern software applications. We'll discuss some of the common ways leaks occur for developers of open source artifacts like containers and software packages. We'll also provide practical insights into scalable credential scanning and ecosystem-level protections for developers and organizations who want to keep their credentials secure to help when every second counts.