A public repository can become an open door
Researchers scanning 7.25 million public repositories on Gitee found 26,400 unique credentials that they verified as working. The credentials included keys for cloud platforms and AI services, among them 9,473 Alibaba Cloud AccessKey pairs, 3,170 DeepSeek keys, and 1,348 OpenAI keys.
That’s a lot of keys left where anyone could find them. But let’s be precise: “verified as working” means the credentials worked when tested. It does not establish that attackers used them, or that every key was still active when the reports appeared.
Deleting the commit doesn’t revoke the key
A leaked credential can give someone access to whatever its permissions allow. Depending on the key, that could mean cloud resources, data, or AI API usage that quietly runs up a bill. And even if someone later removes the key from the repository, copies may remain in commit history, forks, logs, or downloaded clones.
A secret in a public repository is a credential to rotate, not just a line of code to erase.
The original research write-up describes the scan and credential checks. The Hacker News coverage summarizes the findings. This is a separate Gitee dataset, not a new count from the CMS’s recent “Cyber Weekly: Secrets at Risk” roundup.
What to do if one of those keys is yours
If your team publishes code on Gitee, check both current files and repository history for exposed credentials. If you find one, revoke it with the provider first, then issue a replacement with only the permissions it needs. Review access and billing logs for unexpected activity, too.
- Scan public repositories and commit history for secrets.
- Revoke exposed keys at the service that issued them. Don’t rely on deleting the commit.
- Check usage, access, and billing logs for activity you don’t recognize.
- Add secret scanning to your development workflow so the next accidental commit gets caught early.
If you’re not sure whether an exposed key is still a risk, start by treating it as compromised. It’s much easier to rotate a credential now than to explain a surprise cloud bill later.
Book a 15-minute secrets exposure check
We’ll help you identify what to review first, with no obligation.