Researcher finds 26,000 live secrets in Gitee repositories

Independent security researcher Ben Zimmermann conducted a large-scale audit of Gitee, China’s largest Git repository hosting platform, focusing on public code repositories for lingering authentication secrets. The scan examined 7.25 million repositories and identified 26,000 valid, live private credentials exposed across the platform. The leaked secrets affect accounts across Alibaba Cloud, DeepSeek, OpenAI, and Zhipu AI.

The researcher used open-source scanning utilities to parse public repositories and then validated each prospective credential against upstream provider endpoints to confirm active status, removing duplicates to reflect unique secrets. The findings align with a technical research report on Gitee repository secrets, which notes substantial exposure in cloud and AI platforms, including 9,473 Alibaba Cloud access keys, 3,170 DeepSeek API keys, 1,489 Zhipu AI keys, and 1,348 OpenAI keys.

Other exposed items include 3,805 YouTube tokens, 600 GitHub tokens, 338 AWS credentials, and 220 MongoDB keys, with a master administrator credential also appearing among the exposures.

Most exposures arose from developers’ simple oversights, such as committing hardcoded tokens during rapid development cycles. Because Git retains history, removing a key from current files does not purge past revisions, and roughly half of the verified keys dated from commits pushed in 2025. After disclosure, Zimmermann notified affected providers with detailed token data and repository references to aid revocation, but reaching individual developers proved impractical given the volume.

The article recommends that software engineers audit public Gitee repositories immediately, organisations rotate exposed tokens, purge historical commit logs, and implement automated secret scanning prior to deployment.