Exposed credentials are secrets such as passwords, API keys, tokens, or private keys that were unintentionally made available to someone who should not have them. This can happen through code repositories, logs, chat messages, misconfigured storage, browser history, or copied configuration files. Once a secret has been exposed, it should be treated as compromised, even if no misuse has been confirmed yet.
In cyber security, exposed credentials matter because they often give attackers direct, valid access without needing to break in. A stolen cloud token or service principal secret can let an attacker read data, create new access, or delete resources while appearing like legitimate automation. Defenders should rotate or revoke the secret, review related activity, and reduce future risk with least privilege, secret scanning, and protected storage. Redaction alone is not enough if the secret was already seen or copied.