Many Forbes AI 50 Companies Leak Secrets on GitHub

Cloud security firm Wiz analysed GitHub repositories linked to Forbes AI 50 firms and found that 65% of the companies with a GitHub footprint had leaked secrets, including API keys, tokens and credentials tied to services such as Google API, Weights & Biases, Flickr, Infura, ElevenLabs and Hugging Face. According to Wiz, the disclosed secrets could have exposed private models, training data and organisational structures.

The leaked-stock included examples across several notable firms, with ElevenLabs and Langchain praised for their fast response, while nearly half of disclosures did not reach the vendor or received no reply. Wiz noted that some organisations lacked an official disclosure channel, hindering remediation. The findings emphasise the need for public VCS secret scanning, clear disclosure channels to report leaks and prioritising detection of proprietary secret types.