GitGuardian finds 24,008 secrets in public MCP configs
GitGuardian's State of Secrets Sprawl 2026 found 24,008 unique secrets in public MCP configuration files—2,117 still valid—plus a 3.2% leak rate in Claude Code-assisted commits versus a 1.5% baseline. Cursor, Claude Code, and Copilot leave credentials in home-directory configs, logs, and shell history that repo and CI scanners never see.
