wiz.ioarticleClosing the Blind Spot: Securing Personal Repositories in the Software Supply Chain
Wiz research blog on how developers' personal public GitHub repositories create a secrets-exposure blind spot outside org security boundaries, citing that 65% of the Forbes AI 50 had verified secret leaks and 56% of company-impacting secrets lived in personal repos, often granting infrastructure-level access (cloud credentials, CI/CD tokens, AI service keys). It describes Wiz Code's approach: inventorying developer identities to discover the personal repos they own, mapping leaked secrets to attack paths on the Wiz Security Graph, and using an AI-driven "Red Agent" to validate exploitability before triggering rotation/remediation workflows.
TL;DR Wiz details how developers leak org secrets into personal GitHub repos and how it correlates developer identity, repo ownership, and exploitability validation to close that blind spot.
Organisations named here
- Red Agent
- Wiz Research
Technologies named here
- Wiz Code
- GitHub
- Wiz Security Graph
- Wiz Red Agent
- Traditional secret scanning
- Wiz
Techniques named here
- Automated reconnaissance of public GitHub commits
- Identity-driven correlation
Related in DevSecOps
jfrog.comarticleJFrog: The Governance Gap Between Your Policy and Your Pipeline
stepsecurity.ioarticleDev Machine Guard Now Supports Windows - StepSecurity
socket.devwriteupSocket: TanStack npm Packages Compromised
securitylab.github.comadvisory