Secret exposure is the accidental disclosure of a sensitive credential, such as an API token, private key, password, or signing key, in a place where it should not appear. That place might be a public code repository, build log, chat channel, backup, or shared document. The danger is simple: once a secret is visible to the wrong audience, it may be copied, reused, or automated into abuse before anyone notices.
In cyber security, secret exposure matters because many attacks begin with stolen credentials rather than malware. A leaked key can let an attacker authenticate as a trusted service, sign software, read data, or move laterally inside a network. Defenders reduce the risk with secret scanning, access controls, environment variables, vaults, and rapid key rotation. When exposure is suspected, the correct response is usually to revoke the secret, replace it, and review where it may have been replicated.