Blast Radius: What a Leaked Secret Breaks

A leaked credential's risk extends beyond the credential itself — its true impact depends on the downstream services that depend on what it can access. Using a Temporal cluster and an Online Boutique demo, this post demonstrates how identity-local scoring (plaintext, unrotated, overprivileged) and topology-based blast radius scoring complement each other. A key finding: redis-cart, which ships without a password and has no secret to flag, turns out to have the widest application-layer blast radius in the demo environment, causing checkout failures across multiple services. GitGuardian handles credential detection and machine identity risk scoring, while Anyshift's dependency graph maps downstream failure propagation. The post also notes that the remediation itself (rotating a credential) can have its own blast radius by restarting dependent pods.