26,400 Valid Cloud and AI Credentials Exposed in Public Gitee Repositories
Researcher discovers functional secrets accidentally committed to Chinese code-hosting service
Key Takeaways
- Researcher Ben Zimmermann found 26,400 valid cloud and AI credentials exposed in public Gitee repositories.
- The credentials were left behind by developers and remained functional when tested.
- The exposure affects 7.25 million scanned public repositories on the Gitee platform.
- No patch is available; the issue results from accidental secret commits to public code.
- Mitigation involves rotating exposed credentials and using secret scanning tools to prevent future leaks.
Quick answers
- What happened?
- Independent researcher Ben Zimmermann scanned 7.25 million public repositories on Gitee and found 26,400 valid cloud and AI service credentials left exposed in developer code. The credentials, which included keys for various cloud platforms and AI services, remained functional at the time of testing, potentially allowing unauthorized access to anyone who copied them.
- What should defenders do?
- Rotate any credentials that may have been exposed. Add secrets to .gitignore and use secret scanning tools to prevent accidental commits. Implement pre-commit hooks and repository scanning to detect and remove exposed secrets.
A security analysis of 7.25 million public repositories on Gitee, a Chinese code-hosting platform, has revealed that 26,400 cloud and AI service credentials were left exposed and still functional. Independent researcher Ben Zimmermann conducted the scan and reported the findings on October 28, 2026.
The exposed credentials were predominantly keys for cloud infrastructure and artificial intelligence services. While the specific platforms ranking highest were not detailed in the initial report, the exposure represents a significant risk as anyone who copied these credentials from the public code could have used them to access the associated services.
The issue stems from developers accidentally committing secrets—such as API keys and tokens—to public code repositories. Once exposed, these credentials can be harvested and reused by malicious actors. The researcher's testing confirmed that the credentials were active and valid at the time of discovery.
There is currently no patch for this type of exposure, as the root cause is the mishandling of secrets by developers. Affected parties are advised to rotate any potentially exposed credentials and implement stricter secret management practices.
Security Details
The exposure involved valid cloud and AI service credentials found in public code on Gitee. The credentials included keys for various platforms and remained functional at the time of testing, posing a risk of unauthorized access to the associated services.
Mitigation
Rotate any credentials that may have been exposed. Add secrets to .gitignore and use secret scanning tools to prevent accidental commits. Implement pre-commit hooks and repository scanning to detect and remove exposed secrets.
Sources
The Hacker News
26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories
Oct 29, 2026 · 11:33
Original link
Related Security News
AdFection: Zero-Click Spyware Delivery via Digital Ad Bidding
Researchers have identified a technique whereby spyware vendors exploit targeted ad bidding mechanisms in the digital ecosystem to identify and track individuals and organizations of interest. The method leverages the ad bidding process as a zero-click delivery vector for surveillance, raising concerns about the abuse of legitimate advertising infrastructure for espionage purposes.
