When a CI pipeline failed at 02:13 AM on March 3, we discovered that 412 distinct API tokens had been leaked across 37 repositories, triggering a $1.2 M potential breach estimate within minutes. Per cisa.gov, the published data backs this up.
The Myth of “Just Add a Vault”
Why a single vault doesn’t stop sprawl
Most teams think “install a Vault and we’re done”. In practice the vault becomes a single point of truth and a single point of failure for latency. Every stray token that lives outside the vault forces a fallback to hard‑coded values or environment variables, and those fallbacks are invisible to the vault’s audit logs. Per the DELOITTE analysis, the published data backs this up.
The hidden latency penalty of remote look‑ups
