More Than 543,000 Credentials Exposed on GitHub Remain Active
Summary
Truffle Security found 543,699 active credentials among 1.1 million exposed in public GitHub repositories. Many remained valid for years, despite GitHub protections and alerts, because providers did not revoke them.
Key points
- Truffle Security found 1,103,438 exposed credentials while scanning 224 million public GitHub repositories in August 2025; 543,699 were still active when tested in July 2026.
- The median exposure period was 784 days. The oldest active credential was an AWS key committed in 2009.
- Nearly half the active credentials were added after GitHub introduced free alerts and default push protection.
- The exposed credentials included 69,041 Google Cloud service account credentials, 51,067 MongoDB connection strings, and 33,343 Google API keys.
- GitHub’s secret-scanning program alerts issuing providers, but providers are not required to revoke exposed credentials.
- Truffle says push protection can block new exposures, but previously leaked credentials must be revoked or rotated to stop working.
Article Details
- Event Type
- Disclosure of a large-scale exposure of active credentials in public GitHub repositories
- Impact
- Truffle Security reported finding 1,103,438 exposed credentials across 224 million public GitHub repositories scanned in August 2025. When tested against their respective services at the end of July 2026, 543,699 were still active. The exposed credentials included Google Cloud service account credentials, MongoDB connection strings, and Google API keys. The article says GitHub alerts and push protection do not ensure exposed credentials are revoked.
Products
GitHubTruffle Security has discovered over half a million active unique credentials exposed in public GitHub repositories.Google CloudThe list of exposed secrets is dominated by 69,041 Google Cloud service account credentials, 51,067 MongoDB connection strings, and 33,343 live Google API keys.MongoDBThe list of exposed secrets is dominated by 69,041 Google Cloud service account credentials, 51,067 MongoDB connection strings, and 33,343 live Google API keys.