A surprising number of organizations don’t even have a central secrets management plan. Some teams might be using a secrets manager, or rolling their own, but others might have secrets sitting in version control systems like GitHub. They might have them in Excel spreadsheets or even a Post-it note under their keyboard. While most of us know those are not good places to keep secrets, there are plenty of junior developers or other engineers with low security knowledge that are leaving secrets like AWS keys in plaintext and publishing them on public or private repositories — and attackers can often find them in both.