GitGuardian Finds 28.65 Million New Secrets Exposed on Public GitHub in 2025
Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.
Summary
GitGuardian’s 2026 report found 28.65 million new hardcoded secrets in public GitHub commits in 2025, up 34%. Internal repositories showed greater exposure, while 64% of a cohort of credentials leaked in 2022 remained valid in January 2026.
Key points
- GitGuardian analyzed 1.94 billion public GitHub commits in 2025 and reprocessed historical data back to 2021 with updated false-positive filtering for consistent comparisons.
- AI-service secrets totaled approximately 1.28 million, up 81% year over year. Claude Code co-authored commits had a 3.2% credential exposure rate versus 1.5% overall, but their leakage rate converged with the human baseline by December.
- MCP configuration files exposed 24,008 unique secrets; 2,117, or 8.8%, were verified as working at detection.
- In the report’s datasets, 32.2% of internal repositories contained hardcoded secrets versus 5.6% of public repositories. Separately, 28% of internal leak incidents occurred exclusively in collaboration tools and other non-code sources.
- Scanning publicly accessible self-hosted GitLab instances and Docker registries uncovered approximately 80,000 credentials, including 10,000 verified as valid.
- Retesting in January 2026 found that over 64% of the tracked credentials confirmed valid after leaking in 2022 still worked, highlighting persistent failures to revoke or rotate exposed secrets.
- The report recommends scanning beyond repositories, prioritizing remediation using access and privilege context rather than validation alone, centralizing secrets, automating rotation and adopting short-lived workload identities.
Article Details
- Publisher
- GitGuardian
- Report Period
- 2025-01-01 to 2025-12-31
- Scope
- Secrets exposure on public GitHub, internal repositories, collaboration platforms, developer endpoints, and exposed self-hosted GitLab instances and Docker registries; includes longitudinal credential-validity testing.
- Sample Size
- 1.94 billion public commits; endpoint analysis covered 6,943 compromised machines. Internal analyses used GitGuardian customer data.
- Key Statistics
- GitGuardian detected 28.65 million new hardcoded secrets in public GitHub commits during 2025, a 34% increase over 2024.
- Across 2025, 3.2% of Claude Code co-authored commits contained an exposed credential, compared with a GitHub-wide average of 1.5%; this observational comparison does not establish causation.
- Among repositories monitored in 2025, 32.2% of internal repositories contained at least one hardcoded secret, compared with 5.6% of public repositories.
- When previously valid credentials exposed in 2022 were retested in January 2026, over 64% remained valid.
- Public GitHub MCP configuration files exposed 24,008 unique secrets in 2025; 2,117, or 8.8%, were verified as working at detection.
- Recommendations
- Centralize secrets in vault platforms and automate credential rotation and revocation.
- Scan before commits or pushes, continuously monitor internal repositories, and extend detection to collaboration platforms and container images.
- Prioritize remediation using privilege, scope, exposure, and business impact rather than validation status alone; include generic secrets.
- Keep secrets out of MCP configuration files and command-line arguments; use a secrets manager, exclude sensitive configurations from version control, require TLS, and enforce human approval for sensitive actions.
- Inventory non-human identities, establish ownership and access scope, and adopt short-lived, identity-based authentication where feasible.
MITRE ATT&CK
T1195.001 · Compromise Software Dependencies and Development ToolsThe Shai-Hulud 2 attack compromised npm packages and executed malware when those packages were installed.T1552.001 · Credentials In FilesThe Shai-Hulud 2 malware harvested environment files and performed structured local secret scans on compromised development machines.
Threat Actors
Malware
Vendors
Anthropic2. **LLM infrastructure** (RAG, orchestration: Brave Search, Firecrawl, Dify) is growing 5x faster than core AI labs (OpenAI, Anthropic, Groq...).GitGuardianOrganization: GitGuardianGitHub- [Industry snapshots: How enterprise secrets get exposed on public GitHub](#industry-snapshots-how-enterprise-secrets-get-exposed-on-public-github)
Products
Claude Code- [Claude Code co-authored commits leaked secrets twice as much across 2025](#claude-code-co-authored-commits-leaked-secrets-twice-as-much-across-2025)Confluencetimes more likely to be valid. 28% of incidents originate entirely outside repositories—in Slack, Jira, Confluence, and similar tools. These leaks outside of the codebase are 13% more likely to be categorized asDocker- [Unintentionally exposed: 80K secrets leaked on self-hosted GitLab and Docker registries](#unintentionally-exposed-80k-secrets-leaked-on-self-hosted-gitlab-and-docker-registries)GitGuardian VS Code extensionThat is why `ggshield` belongs on the workstation and why the GitGuardian VS Code extension matters.GitHub- [Industry snapshots: How enterprise secrets get exposed on public GitHub](#industry-snapshots-how-enterprise-secrets-get-exposed-on-public-github)GitLab- [Unintentionally exposed: 80K secrets leaked on self-hosted GitLab and Docker registries](#unintentionally-exposed-80k-secrets-leaked-on-self-hosted-gitlab-and-docker-registries)Jira3 to 4 times more likely to be valid. 28% of incidents originate entirely outside repositories—in Slack, Jira, Confluence, and similar tools. These leaks outside of the codebase are 13% more likely to be categorizedOpenClawIn January 2026, OpenClaw (formerly Moltbot) became the fastest-growing project in GitHub history: 17,830 stars in a single day, crossing 200,000 at the time of writing.Slackwere 3 to 4 times more likely to be valid. 28% of incidents originate entirely outside repositories—in Slack, Jira, Confluence, and similar tools. These leaks outside of the codebase are 13% more likely to beSmithery.aiGitGuardian’s security research team disclosed a critical vulnerability in Smithery.ai, one of the most popular MCP server registries, demonstrating how a single path traversal bug in the platform’s Docker build process
Tools
ggshieldGitGuardian offered a response with a `ggshield` skill for OpenClaw that lets users ask their AI assistant “Is this safe to push?”, hoping to claw back some security for the community.Shodanusing a mix of Certificate Transparency Logs hostnames extraction and Internet scanning. This included Shodan product queries and HTTP fingerprinting using GitLab-specific headers. We then confirmed unauthenticatedSPIREFrameworks like SPIFFE, implemented by open source SPIRE, replace “shared string” authentication with strongly attested workload identity, where each workload is issued a verifiable proof of identity.
Industries
Consulting- [Consulting firms: where secrets sprawl becomes a third-party incident](#consulting-firms-where-secrets-sprawl-becomes-a-third-party-incident)fintechcompany’s entire corporate documentation and Kubernetes credentials granting full cluster access to a fintech startup.Healthcaredetected 180+ leaked secrets from public Moltbot workspaces, including a Notion token exposing a healthcare company’s entire corporate documentation and Kubernetes credentials granting full cluster access to a