Emerging ThreatsData Breaches

GitHub Exposes 543,000 Valid Credentials Despite Security Measures

Analyst 207||Source: BleepingComputer
Dimly lit coding workspace with laptop, papers, and empty whiteboards.

More than 543,000 credentials found in public GitHub repositories were still valid in July, according to a sweeping analysis by Truffle Security.

Truffle Security's scan: scope, dataset, and headline figures

Truffle Security scanned a dataset assembled to train large language models, using a crawl that closed on August 7, 2025. The researchers inspected 224 million repositories and more than 58 billion files and identified 543,699 unique credentials that appeared repeatedly across more than 1.1 million files and repositories, including copies in forks. The median time a unique credential remained publicly accessible was 784 days; about 10% of the working credentials were older than 6.3 years, and the oldest dated from 2009.

Secret density and the long arc of exposure

Truffle reports that secret density has increased over time. The number of working credentials per million files rose from 3.72 in 2015 to a peak of 11.62 in 2025. The company also compared GitHub findings to a prior scan of Hugging Face repositories: GitHub contained more than double the number of exposed, working credentials — Truffle found 221,303 working credentials on Hugging Face versus 543,699 on GitHub.

Push Protection: measurable reduction, but important gaps

GitHub’s Push Protection — introduced in April 2022 for Advanced Security users, made available for public repositories in May 2023, and enabled by default for all users in February 2024 — scans incoming code for secret patterns such as API keys and access tokens and blocks uploads it deems to contain secrets. Truffle’s analysis shows two clear effects: first, Push Protection appears effective for the categories it targets — the rate of exposed credentials in protected categories fell by 53% after the feature was enabled by default. Second, Push Protection does not affect credentials that were already public and it does not block every secret type by default. Truffle found that 199,843 of the credentials identified in July were exposed after GitHub activated Push Protection for all users in February 2024, accounting for roughly 36.8% of the total. A little over half (51.8%) of the live credentials fell into categories Push Protection’s default settings do not block, including database connection strings and Google API keys.

Which credentials get revoked — and which do not

The likelihood that an exposed secret is revoked varies dramatically by credential type and by service. Truffle found that of 101,886 committed npm tokens, only 1 still worked at the time of analysis. By contrast, of 126,963 exposed Google Cloud service account credentials, 69,041 were still valid and working. Truffle’s practical recommendations for affected parties are explicit and procedural: immediately rotate exposed credentials, clean up repositories, scan repository history, and set automatic expiration for all active secrets. The researchers also stress a limitation in their findings: the analysis indicates the scale of working secret exposure on GitHub, but it does not reveal what percentage of those secrets have been stolen and abused by attackers.

What this means for technologists, procurement leaders, and end users

  • Technologists and security teams: The report underscores the importance of automated controls plus lifecycle policies. Push Protection reduced exposures where it applies, but Truffle’s data show many secrets remain discoverable for a median of more than two years — teams should rotate secrets, scan histories, and set expirations as Truffle recommends.
  • Affected enterprises and procurement leaders: The uneven revocation rates across services (for example, npm tokens versus Google Cloud service accounts) mean procurement and cloud teams must verify vendor and service-specific revocation practices and require short-lived credentials or automatic expiration where possible.
  • End users and the general public: The presence of long-lived credentials — some dating back to 2009 — means that public repositories can contain active keys that organizations may not realize are exposed; the immediate practical step is to query exposed services and rotate any discovered keys.

Truffle Security’s findings present a mixed picture: protections like Push Protection can and do reduce certain classes of accidental leaks, but large numbers of working secrets remain public, many for years, and significant categories fall outside default scanning. The researchers’ core, concrete advice is procedural and narrow — rotate, remove, scan history, and set expirations — but one question the data leave open is operational: how many of these still-valid credentials have already been harvested and misused. That gap in the record is the next practical problem for defenders and auditors to address.

https://www.bleepingcomputer.com/news/security/over-543-000-valid-credentials-exposed-in-public-github-repositories/

Credential ExposureEmerging ThreatsGithubSoftware DevelopmentSupply ChainVulnerability DisclosureCode SecurityCredential ManagementPublic Repository Risks
Related Intelligence

Continue Reading

Blurred laptop screen at a workstation in a brightly-lit office setting with ordinary equipment and decor.

Microsoft Warns of Dual-RMM Phishing Attacks Deploying ScreenConnect

Beware of phishing attacks that disguise themselves as legitimate software installs - hackers are using fake filenames to trick you into giving them remote control of your device. Microsoft has uncovered a sneaky campaign that uses a genuine MSP360 installer to gain an initial foothold on affected devices.

Analyst 207
Laptop screen glows with lines of code on a plain table in a sparse room.

Teen Researcher Exploits Microsoft Analytics Flaw, Gains Admin Access to 17.3 Trillion Row Database

At just 16, security researcher Faav stumbled upon a massive Microsoft Analytics flaw, using his AI hackbot Antares to uncover a public API endpoint that led to admin access to a staggering 17.3 trillion row database. In a thrilling tale, Faav revealed how he exploited the vulnerability, gaining control with just a few clever moves.

Analyst 207
Dimly lit server room with rack-mounted equipment and scattered cables.

Hackers Exploit Zimbra Flaw to Harvest Authentication Secrets

Hackers are actively exploiting a high-severity flaw in Zimbra Collaboration Suite to gain remote access and harvest sensitive authentication secrets. This vulnerability, patched in July 2026, can be triggered by a specially crafted email, making it a critical threat to unprotected servers.

Analyst 207
Person sitting at desk with laptop open, hands poised over keyboard.

Threat Actors Exploit ChatGPT Custom GPTs in ClickFix Malware Campaign

At least 40 users have fallen victim to a sneaky malware campaign that uses ChatGPT Custom GPT pages and Google Sites to spread a powerful remote access trojan (RAT). Attackers cleverly created fake Custom GPT links that appeared on Google search results, tricking users into downloading the malware.

Analyst 207