Pharmaceutical giant Novo Nordisk suffered an embarrassing but potentially serious security incident when a secret GitHub token — credentials granting access to the company's source code repositories — was inadvertently exposed, providing external parties with access to the company's software development pipeline. The incident highlights what security experts describe as the epidemic of secrets management failure: the widespread practice of hard-coding credentials in source code or configuration files, then accidentally exposing those files through version control systems.

GitHub tokens are among the most dangerous credential types to expose because source code repositories typically contain far more than just code. Modern software development pipelines store configuration files, deployment scripts, environment variable files, and other artifacts that collectively can reveal cloud service credentials, database connection strings, API keys for third-party services, and cryptographic secrets. A GitHub token with sufficient permissions can provide access to an organization's entire technology infrastructure.

The Novo Nordisk incident has been characterized by security researchers as illustrating a systemic problem rather than an isolated error. Development teams working under time pressure frequently take shortcuts with credential management, and the cultural norm in software development of sharing code freely sometimes collides badly with the need to keep credentials secret. Git's version history makes the problem worse: even if a credential is removed from a file, it may persist in the repository's commit history where it can be discovered by anyone with read access.

Enterprise secrets management has emerged as a recognized discipline in response to these risks. Dedicated secrets management platforms — tools like HashiCorp Vault, AWS Secrets Manager, and Azure Key Vault — provide centralized storage for credentials with audit logging, automatic rotation, and fine-grained access controls. These platforms decouple credentials from code, making it possible to rotate secrets without modifying source files and ensuring that compromised credentials can be rapidly revoked without requiring code changes and redeployments.

The deeper lesson from incidents like Novo Nordisk's is that secrets management is fundamentally an identity problem rather than a tooling problem. The question of which code, services, and people should have access to which credentials is an identity and access management question. Organizations that approach secrets management through that lens — establishing clear ownership, implementing least-privilege access, and monitoring for anomalous credential use — achieve significantly better outcomes than those that treat it as a purely technical challenge solved by implementing a secrets management tool.