How to Get Secrets Off Developer Laptops in 2026

Take production secrets off developer laptops and out of plain files, starting with the tokens that can deploy or sign. AWS Secrets Manager bills $0.40 per secret per month plus API calls, with no per-person fee, and Infisical Pro is $20 per identity per month when billed yearly. Put CI on short-lived credentials so no long-lived key has to sit on a laptop at all.

Cyberpresso data: Of the 108 news posts Cyberpresso published in October 2026, 12 describe secrets that had to be rotated after exposure: API keys, tokens, and signing or OAuth client secrets. We counted the October posts whose text says a key, token or secret was or should be rotated. Fourteen use that word, and two were left out because there it describes attacker infrastructure, such as rotating domains or IP addresses. The LiteLLM release and the Railway breach are two of the twelve.

Secrets manager prices and plan limits, read on the vendors' pricing pages on 4 November 2026

Option	What you pay	Billing unit	The limit that matters
AWS Secrets Manager	$0.40 per secret, plus $0.05 per 10,000 API calls	Per secret per month, and per API call	No per-person fee, so the bill grows with secrets and calls, not headcount
Infisical Pro	$20 per identity per month billed yearly, or $23 billed monthly	Per identity per month, human and machine identities	30 days of audit log retention, and unlimited identities on Pro; the 5-identity cap belongs to Free
Doppler Developer	Free for 3 users, then $8 per additional user per month	Per user per month	3 days of activity log retention
Doppler Team	$21 per user per month, free for 14 days	Per user per month	90 days of activity log retention and 100 config syncs

The prices in the table are as of 4 November 2026, read on each vendor's pricing page. Developer machines often hold these credentials in plain files rather than a vault, because many of these tools write them under the home directory by default. The files include the ones cloud, cluster, container and package tools write, plus any .env file a developer keeps.

Why the laptop matters now

Binance's own account of its 29 October incident, posted on 3 November, starts in June 2026. Binance says a Wallet DevOps engineer downloaded a tampered Homebrew installation while looking for an AI coding tool, and that the company replaced that device and rotated the related credentials. In September, Binance says, another engineer was sent a malicious "assignment" repository during a second-round interview, and it ran during setup. Binance adds that the malware "was not detected by the endpoint security protection tools at the time." The sequence below is taken from Binance's post and from our news report on the Binance attack.

On 20 October, routing through the compromised engineer's computer and an internal AI tool, the attacker took control of two Wallet engineers' machines. It soon found that one of them, the Wallet DevOps engineer, had a container deployment permission token on his computer. On 29 October, between 17:15 and 19:56, the attacker logged onto Software Engineer C's computer, one of the two taken over on 20 October, used the credentials stolen from the DevOps engineer to deploy a container, and triggered a malicious script.

The deployment token is the step that turned access into action: it let the attacker deploy a container from a computer other than the one it was stolen from. Binance then says the attacker exploited unauthorized access to an internal wallet signing service.

Which secrets are already on the laptop

Developer tools keep credentials in files, and the vendor docs name the paths. Anyone who gets a shell on the machine can read them.

Credential files and stores the vendor docs name, read on 4 November 2026

Tool	Where the docs put it	What it holds
AWS CLI	~/.aws/credentials	Long-term access keys, stored as plain text
kubectl	$HOME/.kube/config, unless KUBECONFIG names another file	User entries with the tokens or certificates kubectl uses to reach each cluster
Docker CLI	~/.docker/config.json	Registry credentials, depending on the credential store in use
npm	$HOME/.npmrc	Registry auth settings such as _authToken, which the docs say must be scoped to a registry
GitHub CLI	The system credential store, or a plain text file when no store is found	The token that acts for your GitHub account; gh auth status shows where it is kept

A .env file has no vendor path, because the project decides its name and location. Search for it by name across the home directory, not only inside the repos you open each day.

Scan the machine before you move anything. TruffleHog's README shows this usage form for a filesystem scan, with paths to files and directories. The TruffleHog listing on Toolradar covers the tool itself:

trufflehog filesystem path/to/file1.txt path/to/file2.txt path/to/dir

Gitleaks scans files and directories with its dir command. Its README says that with no target given, it scans the current working directory, so point it at the home folder or at a project:

gitleaks dir -v path_to_directory_or_file

Run gitleaks git on each repo as well, because a key deleted in the latest commit is still in the history. The Gitleaks listing on Toolradar covers the same kind of scan. Both scanners match patterns, so a key in a format neither one knows passes unnoticed. A clean scan shows only that the rules found nothing, so rotate anything that has been on a laptop with production access, whatever the scan reports.

How to move production secrets into a manager

Move the production secrets first, and leave a developer's sandbox keys on the laptop where they are cheap to replace. The manager should hold any value that can write to production, sign a release or spend money in a cloud account.

AWS Secrets Manager bills by the secret, not by the person. Its pricing page says you pay based on the number of secrets stored and API calls made, and it prints $0.40 per secret per month and $0.05 per 10,000 API calls. The same page says you are not charged for creating new versions, but the API calls a rotation makes are billed. Its own example counts seven calls per credential per week for rotation, so a rotation schedule adds to the call bill even though the new version is free.

Here is the arithmetic for a 10-developer team with 40 secrets, using only the printed rates. The secrets cost 40 times $0.40, which is $16.00 a month. For calls, assume each developer reads each secret 20 times a day, which is 10 times 40 times 20 times 30, or 240,000 calls a month. At $0.05 per 10,000 calls that is $1.20, so the total is $17.20 a month. The usage figure is our assumption, and it is the number to replace with your own call counts.

Infisical bills per identity, and its pricing page counts human users and machine identities together. The Infisical listing on Toolradar covers the plans. Ten developers on Pro are 10 identities at $20, which is $200 a month billed yearly or $230 billed monthly, before any CI job is counted. The Free plan stops at 5 identities, so a team of ten cannot use it without moving to a paid plan.

Doppler charges per seat, and its pricing page says non-human identities ride free. Ten developers on Developer is 3 free users plus 7 at $8, which is $56 a month. The same ten on Team are $210 a month. The Developer plan keeps activity logs for 3 days, which is short if an incident is found a week after it started, so the log limit can matter more than the seat price.

For the vault products people already use for logins, the comparison is in 1Password vs Bitwarden, the secrets management tools review, and the 1Password and Bitwarden reviews. A manager does not decide who can read a secret. Any identity that a policy allows can read it, and that policy is the control to review first. The subscription price is the smaller cost of running one, and the access list is the larger one.

Replace stored CI keys with short-lived credentials

A CI job that holds a long-lived cloud access key is a laptop secret with a longer life. GitHub Actions can instead request a short-lived token from GitHub's OIDC provider and trade it for a cloud role. The GitHub guide for AWS adds a permissions setting with id-token: write to the workflow, and its trust policy restricts the subject claim. Its first example restricts the subject to one branch:

"token.actions.githubusercontent.com:sub": "repo:octo-org/octo-repo:ref:refs/heads/octo-branch"

The guide warns that repositories created after July 15, 2026, or that opted in to immutable subject claims, get a subject with immutable owner and repository IDs, such as repo:octo-org@123456/octo-repo@456789:ref:refs/heads/octo-branch. Check which form your repo produces before you write the trust condition, because a condition written for one form will not match tokens in the other.

The configure-aws-credentials action README gives this minimal workflow, which requests the token and assumes the role:

permissions:
  id-token: write
jobs:
  run_job_with_aws:
    runs-on: ubuntu-latest
    steps:
      - name: Configure AWS Credentials
        uses: aws-actions/[email protected]
        with:
          role-to-assume: <Role ARN you created in step 2>
          aws-region: <AWS Region you want to use>
      - name: Additional steps
        run: |
          # Your commands that require AWS credentials
          aws sts get-caller-identity

The trust condition is where this goes wrong. A subject that matches every branch, or every repo in an organization, lets any workflow in that scope assume the production role. If a deploy job runs in a GitHub environment, the guide says the subject must name that environment, so use that form for deploys. Short-lived tokens also do not help a developer who runs the same role from a shell, so keep production roles out of personal shell profiles.

Which tokens to rotate first

The order below is our ranking by blast radius, not a vendor rule. Our November 2026 security checklist sets out the rotation steps for the month alongside the patches. Rotate the top items first, and check each one's audit log for use after the exposure date before you revoke it.

1. Deploy and signing tokens. The Binance attacker used a container deployment token to deploy a container on 29 October, and Binance then reports unauthorized access to a wallet signing service. A token that can deploy or sign is the first one to revoke.
2. Cloud keys with production write. A key that can change production infrastructure is worth more to an attacker than a read-only key, and it has the widest effect if it is wrong.
3. CI tokens. A pipeline token reaches every job and repo it can see, and it runs code on a schedule without a person present.
4. Package publish tokens. A stolen npm or PyPI publish token ships a changed package to every downstream user. In the LiteLLM release we covered, the attackers used stolen GitHub CLI credentials to get a poisoned release out, which is why a token that reaches a publish step matters.
5. AI provider keys. A leaked key is billed to your account until someone revokes it, so it ranks below access that changes production. The OpenCode breach shows why these keys are a target of their own.
6. Personal access tokens and the GitHub CLI token. These act as your account, so a leak reaches every repo you can open. Rotate them last, but do not skip them, because the GitHub credentials breach story shows how stolen account credentials travel.

After each rotation, confirm the old value is revoked, not only replaced in one file. A new key in a file while the old key still works leaves the exposure open.

How to stop the next leak

Two GitHub controls stop a secret at the push, and the price depends on whether the repo is public. The table uses the GitHub security plans page, read on 4 November 2026.

GitHub secret controls and what they cost, read on github.com/security/plans on 4 November 2026

Control	What it costs	What it does
Push protection	Free on public repositories; included in GitHub Secret Protection	Blocks a push that contains a recognized secret pattern
Secret scanning	Free on public repositories; included in GitHub Secret Protection	Alerts on secrets already committed to a repo
GitHub Secret Protection	$19 per active committer per month	Brings both controls to private repositories

GitHub prints Code Security at $30 per active committer per month, but this section covers secrets only. The push block works only where the repo has the plan, so a private repo without Secret Protection gets no push gate from GitHub.

The laptop needs its own gate for private repos. The Gitleaks README describes a pre-commit hook set up with a .pre-commit-config.yaml file at the root of the repo, which checks the staged changes before a commit is made. The README also shows a SKIP=gitleaks variable for a commit that should bypass the check, so a hook is a guardrail a developer can turn off, not a lock.

Where this approach breaks

A manager does not help when a long-lived token is pasted into a shell profile or a chat window, where the scanner may not match its format. Infostealers now collect the credential files of AI coding tools as well as browser passwords, as the Aoki infostealer story describes. A copy of a key outside the vault is exposed to the same malware that reads the laptop.

Endpoint protection is a control, not a proof. Binance's account says the malware was not detected at the time, and that the attacker took steps to conceal the activity and remove traces. A team that relies on the endpoint tool to catch a repeat has no second check, which is why the rotation and the audit log matter more than the alert.

An editor extension runs with the developer's own permissions, so a malicious one can reach files the developer can read. The guide to finding malicious editor extensions covers the inventory and the Cursor check, and belongs next to this list.

A cleaned repo does not clean the developer's environment. A Vite dev server exposed beyond localhost can leak files such as a .env. GitHub's advisory for CVE-2026-39364 covers servers exposed with --host or server.host on Vite 7.1.0 to 7.3.1 and 8.0.0 to 8.0.4, fixed in 7.3.2 and 8.0.5. In the campaign we covered, F5's honeypots saw scanners going after AWS and Azure credentials. The scan has to cover running servers as well as files.

FAQ

What is the best way to get secrets off developer laptops in 2026?

Move production secrets into a manager, replace CI keys with short-lived OIDC tokens, and revoke any deploy or signing token first. AWS Secrets Manager bills $0.40 per secret per month plus $0.05 per 10,000 API calls, and Infisical Pro is $20 per identity per month billed yearly.

How much does AWS Secrets Manager cost for 40 secrets?

At the printed rates, 40 secrets cost $16.00 a month before any API calls. Our 10-developer example, with each developer reading each secret 20 times a day, adds $1.20 in calls for a total of $17.20 a month.

Is there a free secrets manager for a small team?

Infisical's Free plan covers 5 identities, and Doppler's Developer plan covers 3 users free, then $8 per additional user per month. AWS Secrets Manager has no seat fee, but each secret costs money from the first one.

Do I need GitHub Secret Protection for a private repo?

To get push protection and secret scanning on a private repo, yes. GitHub prints Secret Protection at $19 per active committer per month, and both controls are free only on public repositories.

Does OIDC replace a secrets manager?

No. OIDC removes a long-lived cloud key from CI, so a pipeline holds nothing worth stealing between runs. A third-party API key has no cloud identity that issues it, so it still needs a manager. The trust condition on the cloud role decides who can assume it, which is the setting to review first.

Which secret should be rotated first after a leak?

Start with a deploy token or a signing key, because a token that can deploy or sign reaches production or money without anything else. The Binance account describes exactly that path, with a container deployment token used from Engineer C's computer, one of the two taken over on 20 October. Revoke it, check the audit log for use after the exposure, and then rotate cloud keys with production write.

Can a secret scanner find every secret?

No. TruffleHog and Gitleaks find strings that match their rules, so a secret in an unfamiliar format can pass.

How we checked this page

We read the AWS Secrets Manager, Infisical, Doppler and GitHub pricing pages, the TruffleHog and Gitleaks READMEs, the AWS CLI, kubectl, Docker, npm and GitHub CLI docs, and GitHub's AWS OIDC guide on 4 November 2026. Prices are the printed rates, and the 10-developer totals are our arithmetic on them, with the one usage assumption stated. The October count comes from our own news archive, as the data line describes.

Louis Corneloup, founder of Toolradar and Dupple, is the author. How products are described is on how we rate, and corrections sit in the editorial policy.

Cite this: Cyberpresso, "How to Get Secrets Off Developer Laptops in 2026", November 2026.

The leaked tokens and poisoned releases behind each step arrive first in the Cyberpresso daily brief.

Some offers on this page may be paid placements or contain affiliate links.