Unsecured Credentials is a MITRE ATT&CK technique for finding secrets stored in files or other local artifacts, such as configuration files, environment files, shell history, build scripts, or application state. The problem is not always that a password is weak; it is that the secret is saved somewhere an attacker can read once they gain access to a device or repository.
This matters because one exposed token, API key, or service account credential can unlock cloud services, CI/CD pipelines, source code, or other internal systems. Attackers often automate searches across common file paths and tool-specific directories to collect reusable secrets at scale. Defenders reduce risk by removing plaintext secrets, using centralized secret managers, issuing short-lived credentials, limiting file permissions, and scanning endpoints and repositories for exposed keys before an intruder does.