Exposed Git Repositories Leak Active Cloud and Service Credentials
Summary
Researchers found 28,000 publicly exposed Git repositories across 3.5 million active web servers, including repositories containing live AWS, Stripe, OpenAI, Telegram, and GitHub credentials and sensitive internal records.
Key points
- Intruder researchers identified 28,000 exposed repositories among 3.5 million scanned active hosts.
- The exposure resulted from web servers allowing public access to their .git directories.
- Researchers recovered more than 400 AWS access keys, 107 live Stripe secret keys, 123 OpenAI keys, 80 Telegram tokens, and 17 GitHub personal access tokens.
- Some credentials provided access to cloud storage and sensitive records, including employee files and payment information.
- Intruder’s gitreaper tool inspects repository history, which can reveal secrets removed in later commits.
- The article recommends blocking public access to .git directories, rotating exposed credentials, and adding automated secret scanning to CI pipelines.
Article Details
- Event Type
- Public exposure of Git repositories caused by misconfigured web servers, exposing active credentials and internal records.
- Impact
- Researchers reported finding more than 28,000 exposed repositories across 3.5 million active hosts, including over 400 AWS access keys, 107 live Stripe secret keys, 123 OpenAI keys, 80 Telegram tokens, and 17 GitHub personal access tokens. Exposed credentials enabled access to internal cloud storage and sensitive records, and created risks of cloud infrastructure takeover and data theft. The number of compromised individual users was not confirmed.