Secrets That Survive Everything: Runtime Credential Exposure in Production Web Applications

Modern web applications rely on shift-left security controls such as static secret scanning and SAST to prevent credentials from reaching production. These controls are mature, widely deployed, and effective at what they scan: source code and repository content. They do not scan what the application serves. This paper documents two real exploitation chains in which Azure Active Directory client credentials, API gateway subscription keys, and encrypted configuration objects were found in the client-side JavaScript, runtime-fetched configuration, and API responses of production applications that had passed every pre-deployment security control in place. In both cases, the exposed credentials were combined with over-permissive service principal scopes to achieve full account takeover or mass user data exposure. The paper maps the structural gap between shift-left tooling and the runtime attack surface, identifies three structural deployment paths and one behavioral path by which secrets reach production without automated detection, and explains why both shift-left and shift-right tooling categories miss this class of vulnerability. A detection methodology for the runtime layer is presented, followed by a prioritized remediation framework covering immediate credential rotation, the OAuth 2.0 Authorization Code flow with PKCE for public-client authentication, architectural remediation via the Backend for Frontend pattern, and ongoing monitoring controls. This version extends the original preprint with a cross-vendor, LLM-validated detection benchmark (GT-194): 194 credentials across eight credential types drawn from 113 production applications. Ten secret-scanning tools are evaluated against a ground truth constructed by Claude Opus 4.7 and independently validated by GPT-5.5 (Brennan-Prediger kappa = 0.822), with pairwise McNemar significance testing and detection-set overlap analysis. The principal finding is structural rather than tool-specific: 13.9 percent of the benchmark is missed by every scanner evaluated, concentrated in the CryptoJS encrypted-configuration class. All findings were identified during authorized security assessments, reported to the affected organizations, remediated, and verified before this publication.