26,400 working cloud and AI keys found in public Gitee repositories
Deleting a leaked key from the code does not make it safe, so any key that appeared in a public Gitee repository should be revoked.
An independent researcher, Ben Zimmermann, scanned 7.25 million public Gitee repositories and found 26,400 cloud and AI credentials that still worked when tested. The largest group was 9,473 Alibaba Cloud AccessKey pairs, followed by YouTube, DeepSeek, Zhipu BigModel and OpenAI keys. He sent lists to the vendors with the most exposed keys but did not contact the developers who leaked them, and he had not confirmed that any had been revoked when he published on October 28. Because scanners read full commit history, deleting a key from the code does not make it safe, and developers are advised to revoke any key that has appeared in a public Gitee repository. The two scanners used, TruffleHog and Kingfisher, found different sets, so teams relying on one should check its coverage.
Why it matters
A researcher's scan of 7.25 million public Gitee repositories found 26,400 cloud and AI credentials that still worked when tested, with 9,473 Alibaba Cloud AccessKey pairs the largest group. Gitee's rate of 3.64 working credentials per 1,000 repositories is higher than the earlier rates reported for GitLab and Bitbucket, so the exposure is not confined to one platform's habits. Because the two scanners found largely different sets, the true number of exposed keys is likely larger than any single tool shows, and anyone who has published keys to a public repository has to assume they are compromised until they are revoked.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.