Audit Finds 26,000 Live Credentials in 7.25 Million Gitee Repositories
Summary
A researcher reported finding 26,000 unique, valid credentials in 7.25 million public Gitee repositories, validating candidates against provider endpoints. About half dated to commits pushed in 2025; affected providers were notified.
Key points
- The audit examined 7.25 million public Gitee repositories and reported 26,000 unique, live credentials after removing duplicates and validating candidates against provider endpoints.
- Reported exposures included 9,473 Alibaba Cloud access keys, 3,170 DeepSeek API keys, 1,489 Zhipu AI keys, and 1,348 OpenAI API keys.
- The researcher also reported 3,805 YouTube tokens, 600 GitHub tokens, 338 AWS credentials, and 220 MongoDB keys.
- About half of the verified keys dated to commits pushed in 2025; removing a secret from current files may leave it in Git history.
- The researcher sent reports to affected providers but said the volume prevented direct outreach to individual developers.
- The article recommends rotating exposed tokens, purging historical commit logs, and using automated secret scanning.
Article Details
- Publisher
- Security Online Info
- Scope
- Public Gitee code repositories scanned for exposed authentication secrets.
- Sample Size
- 7.25 million repositories
- Key Statistics
- The scan found 26,000 unique, valid live credentials.
- Approximately 50% of the verified keys dated to commits pushed during 2025.
- Alibaba Cloud: 9,473 verified access keys.
- DeepSeek: 3,170 operational API keys.
- YouTube: 3,805 tokens.
- Recommendations
- Audit public Gitee repositories for exposed credentials.
- Rotate exposed authentication tokens.
- Purge historical commit logs containing secrets.
- Implement automated secret scanning before deploying software.
MITRE ATT&CK
People
Vendors
Alibaba CloudFurthermore, these leaked secrets expose critical accounts across Alibaba Cloud, DeepSeek, OpenAI, and Zhipu AI.Amazon Web ServicesAdditionally, the audit uncovered 3,805 YouTube tokens, 600 GitHub tokens, 338 AWS credentials, and 220 MongoDB keys.DeepSeekFurthermore, these leaked secrets expose critical accounts across Alibaba Cloud, DeepSeek, OpenAI, and Zhipu AI.GitHubAdditionally, the audit uncovered 3,805 YouTube tokens, 600 GitHub tokens, 338 AWS credentials, and 220 MongoDB keys.MongoDBAdditionally, the audit uncovered 3,805 YouTube tokens, 600 GitHub tokens, 338 AWS credentials, and 220 MongoDB keys.OpenAIFurthermore, these leaked secrets expose critical accounts across Alibaba Cloud, DeepSeek, OpenAI, and Zhipu AI.YouTubeAdditionally, the audit uncovered 3,805 YouTube tokens, 600 GitHub tokens, 338 AWS credentials, and 220 MongoDB keys.Zhipu AIFurthermore, these leaked secrets expose critical accounts across Alibaba Cloud, DeepSeek, OpenAI, and Zhipu AI.