Repository secrets are sensitive credentials kept for software development tasks such as code signing, build automation, deployment, API access, or cloud integration. They may include tokens, passwords, SSH keys, or service account credentials stored in a repository, secret manager, or CI/CD configuration.
They matter because stealing one secret can unlock more than the codebase itself. An attacker who obtains a repository secret may be able to push changes, access private packages, trigger builds, deploy malicious updates, or move into connected cloud services. In supply-chain attacks, secrets are often the pivot point that turns source-code access into broader environment compromise.
Defenders reduce this risk by keeping secrets out of code, using managed secret stores, issuing short-lived and narrowly scoped credentials, and scanning repositories for accidental leaks. Monitoring unusual token use and revoking exposed secrets quickly are also critical.