Credential harvesting — the bulk collection of valid credentials — remains one of the most persistent threats to engineering organizations. Unlike phishing, developer machines are especially vulnerable because cloud keys, API tokens, SSH keys, and AI tool caches sit in plaintext on disk, requiring no user deception. Infostealers exploit this by silently reading known credential locations and exfiltrating them. Key statistics: 39% of breaches involve credential abuse across the full attack chain (Verizon 2026 DBIR), 64% of secrets valid in 2022 were still valid in 2026, and 40% of high/critical secrets on developer laptops appear in AI tool directories. Defenses should cover both vectors: phishing-resistant MFA for the social engineering side, and endpoint credential discovery, honeytoken tripwires, short-lived credentials, and fast revocation for the machine-side harvest. GitGuardian's Developer Endpoint Protection product is presented as a solution for the endpoint layer.
