Developers can't seem to stop exposing credentials in publicly accessible code

One simplistic "how to improve" idea: All real credentials must always be stored on an uber-secure Credentials Server. If any of your code puts them elsewhere - and Sec. Team regularly scans - it's "Instant PIP" for you.

Additionally, most providers now provide out of the box tooling, see: https://docs.github.com/en/code-security/secret-scanning/abo... that can, within minutes, sniff out whether your commits or PR has some creds, and notify you on it.

I think most of those leaks happen when credentials were given to somebody developer-adjacent (data scientist, BI, tech-y PO/PM). You know, somebody that wants to put some scripts together and call it a day. To me, that's more of an oversight on the credentials sharing process rather than a question of developer security awareness. In more enterprisey scenarios, there even is the concept of separation of responsibilities, where devs wouldn't even dream of having creds to any production system, as those are managed by a separate team. Theoretically, once you start getting into SOC2/ISO preparedness, the chance of a developer hardcoding a password/secret in code should be close to 0. Right?