Hardcoded Secrets Security Risk in Mobile and IoT

Someone bought a security camera. They opened the login page in their browser, hit View Source out of curiosity, and found a live GitHub admin token sitting right there in the JavaScript. No reverse engineering. No jailbreak. Just View Source.

That story keeps circulating in security circles because it's so perfectly absurd. A device literally designed to provide security, shipping a credential that could hand an attacker full admin access to the manufacturer's GitHub organization. And here's the thing: it's not a freak accident. It's a symptom.

Key Takeaways

- GitGuardian detected over 12.8 million new hardcoded secrets in public GitHub repos in 2024, a 28% year-over-year increase (GitGuardian State of Secrets Sprawl Report, 2024)

- The average exposed secret stays live for over 400 days after detection, meaning most leaked credentials are never revoked quickly enough to matter

- Pre-commit hooks, GitHub push protection, and short-lived token exchange flows are the three highest-leverage interventions for mobile and embedded teams

What Actually Happened With the Security Camera Token — And Why It Keeps Happening?

In 2024, GitGuardian detected over 12.8 million new hardcoded secrets exposed in public GitHub repositories, a 28% increase year-over-year (GitGuardian State of Secrets Sprawl Report, 2024). The camera incident isn't an outlier. It's one of millions of variations on the same story.

Here's how it typically goes. A developer is debugging a firmware build or wiring up a CI/CD integration. They hardcode a token to make local testing easier. It works. They ship. Nobody reviews the static assets that go into the device's embedded web UI, because those aren't in the diff in the same obvious way that application code is. The token sits there, in a JavaScript bundle, loaded by every login page on every device that ships.

The login page vector is especially alarming. With a mobile app binary you at least have to know what you're doing to extract and inspect it. With a web-served login page, any curious user with a browser can see exactly what you shipped. There's no barrier at all.

This also isn't limited to small manufacturers cutting corners. We've seen similar patterns in enterprise IoT platforms and in mobile apps from companies with mature engineering orgs. The root cause isn't sloppiness. It's that the path from "this worked in dev" to "this is now on a million devices" has too few checkpoints for static assets and firmware artifacts.

How Bad Is the Hardcoded Secrets Problem Across Mobile and IoT?

A 2023 analysis of 4 million Android and iOS apps found that 5.7% contained hardcoded credentials, API keys, or OAuth tokens directly in the app binary or bundled web assets (Symantec Mobile Threat Defense Research, 2023). That's roughly 228,000 apps with live credentials baked in. IoT and embedded device vulnerabilities accounted for over 33% of all enterprise security incidents in 2024, with firmware and hardcoded credentials cited as leading causes (Forrester IoT Security Report, 2024).

The numbers get worse when you look at response times. Only 4% of exposed secrets detected on GitHub in 2023 were revoked within 1 hour of exposure. The average secret remains live for over 400 days after being leaked (GitGuardian State of Secrets Sprawl Report, 2024). Think about that for a moment. A token ships in a device firmware update. It gets detected, maybe by a security researcher, maybe by GitGuardian's scanning. And it's still valid 13 months later on average.

Generic API keys and HTTP authentication credentials account for approximately 45% of all leaks, making them by far the largest category (GitGuardian State of Secrets Sprawl Report, 2024). These aren't exotic credentials that require complex tooling to generate or use. They're the everyday tokens that developers grab from a dashboard and paste into a config file.

What's the Real Blast Radius of an Exposed Admin Token?

OWASP ranks Security Misconfiguration, which includes hardcoded credentials and exposed admin tokens, as the #5 most critical web application security risk (OWASP Top 10, 2021). But that ranking undersells the specific damage a GitHub admin token can cause.

An admin token to a GitHub organization isn't read access. It's the keys to your entire software supply chain. An attacker can read all private repos, including ones containing other secrets. They can push code to protected branches. They can modify CI/CD pipeline configurations to inject malicious steps into every future build. They can create or modify GitHub Actions workflows to exfiltrate environment variables from your build systems.

Software supply chain attacks grew 742% between 2019 and 2022, with credentials and secrets being the most common attack vector in supply chain compromises (Sonatype State of the Software Supply Chain, 2022). That trajectory hasn't slowed. With one admin token from a camera's login page, an attacker could potentially poison packages that get installed by thousands of downstream users who have nothing to do with the camera.

The average cost of a data breach reached $4.88 million USD in 2024, with stolen or compromised credentials being the most common initial attack vector at 16% of breaches (IBM Cost of a Data Breach Report, 2024). That's the average. An admin token that enables supply chain poisoning could multiply that number significantly.

Why Do Developers Keep Making This Mistake — And Why Is Mobile Especially Vulnerable?

Companies take an average of 292 days to identify and contain a breach caused by a stolen or compromised credential, compared to a 207-day average across all breach types (IBM Cost of a Data Breach Report, 2023). The detection gap is real, and it's worse for mobile and embedded teams.

Here's the core problem: PR review catches things that look like code. It catches logic errors, naming conventions, obvious bugs. It's much worse at catching things embedded in build artifacts, bundled assets, or minified JavaScript that ends up in a firmware image.

Build pipelines are often the culprit. A developer adds an environment variable injection step so that the CI system can call GitHub's API during the build. That variable gets baked into a JavaScript constant. The JS gets minified and bundled. The bundle goes into the firmware image. Nobody looks at the firmware image the same way they'd look at a pull request. By the time it's on devices, it's done.

The pattern is similar to what we've covered in common security audit failures: the vulnerability isn't exotic, but the detection gap between writing the code and finding the problem in production is huge. For mobile specifically, what gets shipped inside app bundles is often under-reviewed compared to the application logic itself.

What Does a Secure Secrets Workflow Actually Look Like?

GitHub's secret scanning feature blocked over 1 million leaked secrets in 2023 across public and private repositories through its push-protection feature (GitHub Security Blog, 2023). That's the easiest free win for any team using GitHub: turn on push protection right now if it isn't already on.

Beyond that, the workflow that actually works has a few layers:

Pre-commit hooks. Tools like `detect-secrets` and `truffleHog` run locally and catch secrets before they ever hit a remote. The friction is minimal. The catch rate on obvious patterns is high. This is the line closest to where the mistake happens.

Secret managers for runtime config. AWS Secrets Manager, HashiCorp Vault, and Doppler all solve the same problem: your application never holds a credential at rest. It fetches what it needs at runtime, using a short-lived identity credential, and the actual secret never touches a build artifact. For IoT devices, this means short-lived token exchange flows, not baked-in credentials. The device authenticates with a device certificate and exchanges for a scoped, time-limited token.

Never put secrets in app bundles or firmware. This sounds obvious. It keeps being violated. The rule has to be a hard technical constraint, not a social norm. If your build pipeline can't produce a firmware image without including a secret, that's a pipeline architecture problem that needs fixing before the next ship date.

This connects directly to how fintech teams approach credential architecture. The patterns translate. Short-lived tokens, strict scoping, no ambient credentials sitting in artifacts.

How Do You Respond When a Secret Has Already Shipped?

Only 4% of exposed secrets are revoked within an hour (GitGuardian State of Secrets Sprawl Report, 2024). That number should make you angry at your own incident response process. The first hour after a secret is exposed is when the blast radius is still containable.

When you find a shipped secret, the sequence is:

For teams thinking about supply chain risk more broadly, building resilient systems that fail gracefully under attack is the right mental model. You design for the assumption that something will eventually go wrong.

Checklist: The Pre-Ship Secret Audit Every Mobile and Embedded Team Needs

This is the thing most teams skip, and it's where the camera incident could have been caught:

Binary and asset scanning

CI/CD pipeline audit

Firmware image inspection

Third-party SDK assessment

Vendor and supply chain review

For teams doing a broader security assessment, the patterns that come up in technical due diligence almost always include secret hygiene. It's one of the first things any serious auditor checks.

The security camera token story is embarrassing for the manufacturer. But the more important story is that there are almost certainly many other devices and apps right now with the same problem, waiting for someone curious enough to hit View Source.

Frequently Asked Questions

How do GitHub admin tokens end up shipping inside production apps and device firmware?

In 2024, GitGuardian found that build pipeline injection is a leading cause: tokens get added as environment variables for CI/CD use, then accidentally baked into static JavaScript bundles or firmware assets during compilation (GitGuardian State of Secrets Sprawl Report, 2024). Developers often don't realize the build output contains the variable's resolved value, not a reference to it.

What is the real-world blast radius if an admin token is exposed in a mobile or IoT device login page?

An exposed GitHub admin token can grant full repository access, CI/CD pipeline manipulation, and supply chain poisoning capability. Software supply chain attacks grew 742% between 2019 and 2022 (Sonatype State of the Software Supply Chain, 2022), and a single admin token is often sufficient to compromise an entire organization's build infrastructure and downstream package consumers.

What tools and CI/CD practices can detect and block hardcoded secrets before they reach production?

GitHub's push protection blocked over 1 million leaked secrets in 2023 alone (GitHub Security Blog, 2023). Pair that with pre-commit hooks using `detect-secrets` or `truffleHog`, and add binary scanning of compiled artifacts as a required CI gate. Scanning source code alone misses secrets that get baked into build outputs from environment variable injection.

How should mobile and embedded engineers structure secret management to avoid ever committing credentials?

The IBM Cost of a Data Breach Report (2024) found that credential breaches cost an average of $4.88 million and take 292 days to contain. The architecture that prevents this: devices authenticate using short-lived identity certificates, exchange those for scoped runtime tokens fetched from a secret manager like Vault or AWS Secrets Manager, and nothing sensitive ever touches a build artifact or firmware image.

Is the 400-day average secret lifespan realistic for mobile and IoT deployments?

Yes, and it's likely worse for firmware. GitGuardian's data shows only 4% of secrets are revoked within an hour of exposure (GitGuardian State of Secrets Sprawl Report, 2024). Mobile app and firmware update cycles mean that even after a secret is revoked, old device builds containing it may continue running in the field for months or years without forced updates.

If you're building mobile or embedded systems and want a thorough review of your secrets hygiene and supply chain posture, Luma Commons does exactly that kind of technical audit.