cyber.hendryadrian.com
Security News · cert-agid.gov.it

543,699 Valid GitHub Credentials Found in AI Training Dataset

· Original article ↗

Summary

Truffle Security found 543,699 valid credentials in code from public GitHub repositories included in The Stack v3, an AI-training dataset. CERT-AGID advises treating exposed credentials as compromised and provides ways to check repositories and scan for secrets.

Key points

  • The analysis found 543,699 still-valid credentials, including API keys, access tokens, database credentials and service-account credentials.
  • The credentials were found in The Stack v3, a 15.9 TB dataset built from about 224 million public GitHub repositories.
  • The average age of the working credentials was 784 days; some had remained public for years without being revoked.
  • Published credentials may persist in files, forks or repository copies, so exposed credentials should be revoked or rotated before cleaning the repository history.
  • Repository owners can check for inclusion in The Stack using Hugging Face’s “Am I in The Stack?” service.
  • CERT-AGID recommends scanning GitHub repositories with TruffleHog; its `--results=verified` option filters results to credentials verified as still usable.

Article Details

Event Type
Research finding: valid credentials were identified in code from public GitHub repositories included in The Stack v3 training dataset.
Impact
Truffle Security reported 543,699 still-valid credentials, including API keys, access tokens, database credentials, and service-account credentials. Their average age was 784 days. The article warns that exposed credentials may persist in repository copies, forks, or datasets and should be treated as compromised and revoked or rotated.

Products

Am I in The Stack?Il CERT-AGID consiglia di verificare se i propri repository GitHub sono presenti nei dataset The Stack, a tal proposito è possibile utilizzare il servizio Am I in The Stack?GitHubUna ricerca di Truffle Security ha individuato 543.699 credenziali ancora valide all’interno di codice proveniente da repository pubblici GitHub.The Stack v3L’analisi è stata condotta su The Stack v3, un dataset pubblico di 15,9 TB, utilizzato per l’addestramento di modelli di intelligenza artificiale dedicati al codice e costruito a partire da circa 224 milioni di

Tools

TruffleHogInoltre, per individuare eventuali credenziali esposte nei repository della propria organizzazione su GitHub, è possibile utilizzare strumenti come TruffleHog.

Related Articles