Skip to content
NewA calmer, faster ZeroHour
StoryData breachhigh

Scan finds 26,400 live credentials in public Gitee repositories

2 sources · 2 articlesFirst reported Updated ()3
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

A scan of 7.25 million public Gitee repositories verified 26,400 live cloud and AI credentials.

Researcher Ben Zimmermann, with MongoDB’s Kingfisher team, enumerated 7,256,531 public Gitee repositories and verified 26,400 unique live credentials using TruffleHog and Kingfisher. The set includes cloud keys, led by 9,473 Alibaba Cloud AccessKey pairs, plus YouTube, DeepSeek, Zhipu BigModel, and OpenAI keys, and an active organization-admin credential for an unnamed enterprise AI platform. Full commit histories were scanned, so keys later removed from current files still counted; 12,242 had 2025 commit dates and some dated to the late 2000s. He notified vendors holding the most keys but not developers, and had not confirmed revocations when he published on October 28. Gitee has no public equivalent of GitHub’s vendor secret-scanning partnerships, and he wrote that a leak-rate comparison with GitLab and Bitbucket is not conclusive.

Key facts
  • TruffleHog validated 12,737 keys and Kingfisher 14,664, with 1,001 found by both.
  • Username seed corpus held 1,704,759 names; the Modal scan cost $3,097.64.
  • Enumeration used user search, Explore feeds, profiles, and an Elasticsearch widget.
  • Deleting or rewriting history does not revoke a key at the provider.
  • Vendors with the most keys were notified; developers were not, and revocations were unconfirmed.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 28, 2026Zimmermann published findings on 26,400 live Gitee credentials. · The Hacker News

What each outlet adds

beyond the shared facts
  • Hacker NewsAdds scan method, seed size, Modal cost, and GitHub partnership gap.
  • The Hacker NewsAdds provider counts, scanner split, commit dates, and notification status.
Vendors
Alibaba CloudGoogleOpenAIDeepSeekZhipuOSChinaMongoDB
Products
GiteeYouTube APIBigModelTruffleHogKingfisher
Organizations
Truffle SecurityMongoDBMinistry of Industry and Information Technology
Countries
China

Coverage

oldest first · one row per article · UTC
  1. · 2d ago Hacker News · securityFirst report

    26,400 live credentials found scanning 7.25M Gitee repos

    TruffleHog and Kingfisher verified cloud keys and an unnamed enterprise AI platform's organization-admin credential.

  2. · 1d ago The Hacker News

    26,400 working cloud and AI keys found in public Gitee repos

    A scan of 7.25 million repositories kept only keys that still authenticated, led by 9,473 Alibaba Cloud AccessKey pairs.