OpenSSF Community Day Japan 2025

Every day, thousands of API keys, credentials, and tokens are accidentally leaked into public Git repositories, putting users and organizations at massive risk. In this lightning talk, I'll quickly break down why secret sprawl happens despite increasing awareness. I’ll highlight real-world cases like Trufflehog's recent discovery of over 12,000 live API keys inside DeepSeek's AI model training data, demonstrating how leaked secrets can silently persist and escalate risks. I'll demonstrate how simple open source tools like Gitleaks, Trufflehog, and Git pre-commit hooks can detect and prevent exposures. Attendees will leave with immediate, practical steps to stop secret leaks in their repositories — before attackers find them.