Researcher Ben Zimmermann scanned 7.25 million public repositories on Gitee, a Chinese code host, and found 26,400 credentials that still worked.
What he found
Most were cloud and AI service keys, led by 9,473 Alibaba Cloud AccessKey pairs. He used TruffleHog and Kingfisher, which test each key against the service and read the full commit history, so keys “deleted” in later commits still counted. He told the biggest vendors but not the developers, and he hadn’t confirmed any were revoked.
What to do
If you ever pushed a key to a public repo, anywhere, assume it’s burned. Rotate it. Removing it in a later commit doesn’t help, because history keeps it. My how-to in this batch shows how to scan your own repos before you push.
God Bless, and Needs Garlic!
