26,400 Working Cloud and AI Credentials Found in Public Gitee Repositories

Oct 29, 2026 · Original article ↗

Summary

A researcher found 26,400 working cloud and AI credentials in 7.25 million public Gitee repositories. Revocation and possible misuse were unconfirmed; the scan also found that two secret scanners detected largely different credentials.

Key points

Independent researcher Ben Zimmermann reported finding 26,400 working credentials by scanning 7.25 million public Gitee repositories.
The largest groups were 9,473 Alibaba Cloud AccessKey pairs, 3,805 YouTube API keys, 3,170 DeepSeek keys, and 1,489 Zhipu BigModel keys.
The scanners tested credentials against their issuing services and examined full repository commit histories, so keys later removed from code could still be counted.
TruffleHog found 12,737 credentials and Kingfisher found 14,664, but only 1,001 appeared in both results; each scanner also lacked coverage for some services.
Zimmermann said he notified vendors with the most exposed keys, but had not confirmed revocation or whether anyone had used the credentials.
The article recommends revoking any key that appeared in a public Gitee repository; deleting it from code or rewriting history does not revoke it.

Article Details

Publisher: The Hacker News
Report Period: Results reported 2026-10-28; scan ran for about one month, but its dates were not disclosed.
Scope: Working credentials found in public Gitee repository histories using TruffleHog and Kingfisher.
Sample Size: 7.25 million public Gitee repositories scanned; 26,400 unique credentials reported working.
Key Statistics: 26,400 credentials were reported as working, with each credential counted once regardless of how many repositories contained it.
9,473 Alibaba Cloud AccessKey pairs were found, the largest reported service group.
TruffleHog found 12,737 credentials and Kingfisher found 14,664; only 1,001 were found by both.
By commit date, 12,242 credentials came from 2025.
The reported rate was 3.64 working credentials per 1,000 Gitee repositories; the article cautions that this does not establish which platform leaks more.
Recommendations: Treat any key that has ever appeared in a public Gitee repository as exposed and revoke it at the provider.
Do not rely on deleting a key from code or rewriting repository history to revoke it.
Teams relying on a single scanner should verify that its detectors cover the services they use.

People

Ben ZimmermannIndependent researcher who scanned public Gitee repositories, tested credentials with secret scanners, and reported the findings.

Vendors

Alibaba Cloudand reported the results on October 28. Most were keys for cloud and AI services, led by 9,473 Alibaba Cloud AccessKey pairs.Amazon Web Services1,489 keys for Zhipu's BigModel AI platform, and 1,348 OpenAI keys. Smaller numbers were found for GitHub, AWS, Google Cloud and Google's Gemini.DeepSeekAfter the Alibaba Cloud keys, the largest groups were 3,805 YouTube API keys, 3,170 DeepSeek keys, 1,489 keys for Zhipu's BigModel AI platform, and 1,348 OpenAI keys. Smaller numbers were found for GitHub, AWS, Google Gitee26,400 credentials that developers left in public code on Gitee, a Chinese code-hosting service, still worked when a researcher tested them. Anyone who copied one from that code could have used it.GitHubkeys, 1,489 keys for Zhipu's BigModel AI platform, and 1,348 OpenAI keys. Smaller numbers were found for GitHub, AWS, Google Cloud and Google's Gemini.Googlekeys for Zhipu's BigModel AI platform, and 1,348 OpenAI keys. Smaller numbers were found for GitHub, AWS, Google Cloud and Google's Gemini.MongoDBMongoDB makes Kingfisher, and Zimmermann's post was developed with its Kingfisher team.OpenAIwere 3,805 YouTube API keys, 3,170 DeepSeek keys, 1,489 keys for Zhipu's BigModel AI platform, and 1,348 OpenAI keys. Smaller numbers were found for GitHub, AWS, Google Cloud and Google's Gemini.Truffle Securitythe code or rewriting the repository's history does not revoke it, as noted by TruffleHog's maker, Truffle Security.ZhipuAlibaba Cloud keys, the largest groups were 3,805 YouTube API keys, 3,170 DeepSeek keys, 1,489 keys for Zhipu's BigModel AI platform, and 1,348 OpenAI keys. Smaller numbers were found for GitHub, AWS, Google Cloud

Products

Tools

KingfisherHe ran two secret scanners, TruffleHog and Kingfisher, over every repository. Both tried each credential against the service that issued it and kept only those that worked, he wrote.TruffleHogHe ran two secret scanners, TruffleHog and Kingfisher, over every repository. Both tried each credential against the service that issued it and kept only those that worked, he wrote.