The security perimeter has shifted from the network to identity, and now to the developer endpoint itself. Developer laptops accumulate long-lived credentials — cloud access keys, API tokens, SSH keys, .npmrc tokens, and secrets cached by AI coding agents — in config files and shell history. No existing security layer (network controls, IAM, PAM, EDR, or repo secret scanning) is responsible for inventorying these at-rest credentials. Real-world attacks like the s1ngularity npm supply chain attack and the Shai-Hulud worm demonstrate that attackers exploit this gap by scanning developer machines for valid credentials rather than breaking through the perimeter. The argument is that endpoint credential discovery — finding and revoking exposed secrets before attackers use them — is the missing control that bridges identity security and endpoint protection.
