Secrets exposure is the accidental disclosure of credentials, API tokens, encryption keys, session cookies, or other sensitive data. In secure systems, these values must stay private because they prove identity or unlock protected services. If they leak, an attacker may be able to log in, call internal APIs, decrypt data, or impersonate trusted systems.
In real attacks, secrets often surface in source code, environment files, logs, crash reports, debug output, backups, or misconfigured cloud storage. In AI-generated or rapidly built applications, poor review can make these leaks easier to miss. Defenders reduce the risk with secret scanning, code review, log redaction, vault-based secret storage, short-lived tokens, rotation, and least-privilege access. The key rule is simple: treat any exposed secret as compromised until it is removed and replaced.