CybersecurityCloud Security

Exposed Cloud Credentials Abound in Public Gitee Repositories

Analyst 207||Source: TheHackerNews
Modern tech company interface on a large computer screen with blurred coding content and office background.

26,400 credentials left in public Gitee repositories still worked when an independent researcher tested them, a finding that underlines how long-discarded secrets can remain live and exploitable.

What the scan found: the numbers and services

Independent researcher Ben Zimmermann reported on October 28 that a scan of 7.25 million public Gitee repositories turned up 26,400 distinct, working credentials. The count treats each credential once, even if it appeared in multiple repositories. By commit date, 12,242 of those credentials came from 2025, and some dated back to the late 2000s.

The largest single group was 9,473 Alibaba Cloud AccessKey pairs. Other notable totals were 3,805 YouTube API keys, 3,170 DeepSeek keys, 1,489 keys for Zhipu’s BigModel AI platform, and 1,348 OpenAI keys. Smaller numbers were found for GitHub, AWS, Google Cloud and Google’s Gemini. Zimmermann also reported “an active organization-admin credential for a major enterprise AI platform,” without naming the platform.

How the credentials were validated: TruffleHog and Kingfisher

Zimmermann ran two secret scanners—TruffleHog (from Truffle Security) and Kingfisher (from MongoDB)—over every repository. Both scanners tried each credential against the issuing service and kept only those that worked. The scan ran for about a month, although Zimmermann did not provide the scan dates.

The two tools returned different but complementary results. TruffleHog found 12,737 working credentials and Kingfisher found 14,664; only 1,001 credentials were found by both tools. TruffleHog found almost all of the Alibaba Cloud keys, while Kingfisher found all 1,489 BigModel keys because TruffleHog has no detector for Zhipu’s keys. Zimmermann’s post was developed with the Kingfisher team.

Both scanners inspected each repository’s full commit history, so a key a developer later removed could still be found and counted.

Practical consequences tied to the exposed credentials

What a working key lets an attacker do depends on the service. OpenAI warns that a compromised key allows another person to use the account’s quota and can cause “data loss, unexpected charges,” a used-up monthly quota, and interrupted API access. Google says a YouTube API key is a Google Cloud API key and, without API restrictions, “such a key can be used with every API that accepts Google Cloud keys.”

Zimmermann sent vendors that had the most exposed keys a list of their credentials but did not contact the developers who leaked them. When he published, he had not confirmed that any of the reported credentials had been revoked, and he did not say whether anyone else had used them. The post therefore reinforces a simple operational reality: anyone who has pushed a key to a public Gitee repository cannot assume it has been revoked.

Remediation steps published by vendors and tools

  • Alibaba Cloud: create a new AccessKey pair, switch applications to it, then disable and delete the old pair. Check for unexpected charges and for resources created or deleted that were not needed; use ActionTrail to show the key’s API calls for the last 90 days and check service-specific logs for data operations.
  • Google and YouTube API keys: rotate the key to create a new key with the same restrictions, update applications to use it, then delete the old key; add API restrictions so the key works only with needed APIs.
  • OpenAI: rotate the key immediately from the API Keys page and set spend limits to help limit charges from a leaked key.
  • Note from Truffle Security and tool behavior: deleting a key from code or rewriting repository history does not revoke the key.

What this means for developers, security teams, and enterprises

Developers — Treat any key that has ever been in a public Gitee repository as exposed and rotate or revoke it at the provider. Removing a secret from code or rewriting commits is not sufficient.

Security teams and enterprises — Relying on a single secret-scanning tool can miss large classes of credentials: in this exercise, TruffleHog and Kingfisher each found about half of the total and overlapped on only 1,001 items. Teams should verify scanner detectors against the services they use and correlate scanner output with provider logs and billing data for evidence of abuse.

The scan’s blunt takeaway is immediate and concrete: public keys stay usable until the provider revokes them, and researchers found tens of thousands of them on Gitee. For any organization that uses Gitee or that has code mirrored there, the urgent question is not whether a key once appeared in a repository, but whether it still works—and whether someone else has already used it.

Original Hacker News report

Cloud MisconfigurationCloud SecurityCredential ExposureEmerging ThreatsSupply ChainAPI Key ManagementExposed CredentialsAlibaba CloudPublic Repository RisksGitee
Related Intelligence

Continue Reading

Sleek AI workstation sits at center of modern security operations center.

AI Redefines Security Operations with Emerging Threat Operator Role

AI is revolutionizing security operations by taking over tasks traditionally handled by security analysts, paving the way for a new era of AI-driven threat detection and response. By integrating functions like threat intelligence, hunting, and incident response, AI agents can now tackle security challenges with unprecedented speed and efficiency.

Analyst 207
Windows 11 laptop on a desk with update progress on screen in a modern office setting.

Microsoft Releases KB5127936 Update, Bolstering Windows 11 Security and Features

Microsoft just dropped a new update, KB5127936, for Windows 11, packing 41 changes and fixes to supercharge your experience. This optional update is a sneak peek at what's coming next, and you can grab it now from the Microsoft Update Catalog to try out the latest features and improvements.

Analyst 207
A laptop sits on a clean surface with a blurred screen and subtle background of out-of-focus computer equipment.

GitHub Fortifies npm with Package Firewall to Thwart Malicious Installs

GitHub is stepping up its security game with a new package firewall for npm, blocking suspicious packages from being installed and protecting against malware attacks. This innovative firewall acts as a gatekeeper, inspecting metadata requests and package downloads to keep your systems safe.

Analyst 207
Factory interior with CNC milling machine and Windows servers on a rack in the background.

Hackers Exploit Anger, Not Weak Passwords

You'd think hackers would target weak passwords, but surprisingly, they're more likely to exploit your emotions - specifically, your anger. A recent factory network scan revealed few obvious entry points, but it's what hackers use to get inside that might just surprise you.

Analyst 207