Researcher Finds 26,400 Live Credentials in Public Gitee Repos

Independent researcher Ben Zimmermann scanned 7.25 million public Gitee repositories and found 26,400 credentials that “still worked” when tested, meaning anyone who copied a key from the public code could have used it. The credentials mostly consisted of cloud and AI service keys, with Alibaba Cloud AccessKey pairs making up the largest group (9,473). The haul also included 3,805 YouTube API keys, 3,170 DeepSeek keys, 1,489 keys for Zhipu’s BigModel AI platform, and 1,348 OpenAI keys.

The researchers’ tests used two scanners, TruffleHog and Kingfisher, which searched each repository’s full commit history; the two tools found overlapping results but not in complete agreement—12,737 keys were found by TruffleHog and 14,664 by Kingfisher, with only 1,001 in common.

Zimmermann reported the exposed credentials to the providers most impacted, but did not contact the developers who leaked them, and he had not confirmed revocation at publication. Some keys dated back to the late 2000s, with 2025 dates accounting for about 12,242 of the credentials. A notable credential described as “an active organisation-admin credential for a major enterprise AI platform” was flagged, though the platform was not named.

The article explains that the impact of a working key depends on the service; for example, compromised OpenAI keys can allow misuse of quotas, potentially causing data loss, unexpected charges, or service disruption. The piece also outlines revocation steps for Alibaba Cloud, Google/YouTube API keys, and OpenAI keys, and notes differing results between TruffleHog and Kingfisher across the credential set. SOURCE_UNAVAILABLE