Secrets That Survive Everything: Runtime Credential Exposure in Production Web Applications

Modern web applications rely on shift-left security controls such as static secret scanning and SAST to prevent credentials from reaching production. These controls are mature, widely deployed, and effective at what they scan: source code and repository content. They do not scan what the application serves. This paper documents two real exploitation chains in which Azure Active Directory client credentials, API gateway subscription keys, and encrypted configuration objects were found in the client-side JavaScript, runtime-fetched configuration, and API responses of production applications that had passed every pre-deployment security control in place. In both cases, the exposed credentials were combined with over-permissive service principal scopes to achieve full account takeover or mass user data exposure. The paper maps the structural gap between shift-left tooling and the runtime attack surface, identifies three structural deployment paths and one behavioral path by which secrets reach production without automated detection, and explains why both shift-left and shift-right tooling categories miss this class of vulnerability. A detection methodology for the runtime layer is presented, followed by a prioritized remediation framework covering immediate credential rotation, the OAuth 2.0 Authorization Code flow with PKCE for public-client authentication, architectural remediation via the Backend for Frontend pattern, and ongoing monitoring controls. This version extends the original preprint with a cross-vendor, LLM-validated detection benchmark (GT-198): 198 client-exposed credential values (161 static values plus 37 CryptoJS-encrypted configuration blobs) drawn from 56 benchmark applications within a credential-bearing set of 113 production applications. Ten secret-scanning tools are evaluated against a ground truth constructed by Claude Opus 4.7 and independently cross-validated by GPT-5.5 (89.9 percent high-confidence confirmation), with Holm-corrected pairwise McNemar significance testing and detection-set overlap analysis. The principal finding is structural rather than tool-specific: 14 of the 161 static values (8.7 percent) are recovered by no scanner at actionable severity, and all 37 CryptoJS encrypted-configuration values are missed by every evaluated static scanner, the clearest deployment-layer blind spot in the corpus. All findings were identified during authorized security assessments, reported to the affected organizations, remediated, and verified before this publication.