In August 2025, Truffle Security scanned 224 million public GitHub repositories and found over 1.1 million exposed credentials. By July 2026, 543,699 of these credentials were still active. The exposure window has a median of 784 days, with some credentials dating back to 2009. Despite GitHub's default push protections and secret scanning alerts, many credentials remain active because providers do not mandate revocation upon detection. The exposed secrets include 69,041 Google Cloud service account credentials, 51,067 MongoDB connection strings, and 33,343 Google API keys. The issue stems from the lack of automated revocation pipelines rather than the absence of detection controls.

The exposure of over half a million active credentials publicly on GitHub poses a significant risk of unauthorized access to cloud services, databases, and APIs. The persistence of these active credentials increases the attack surface for potential misuse. However, the impact is mitigated by GitHub's push protections and secret scanning alerts, which help prevent new exposures. The main risk remains from credentials already exposed and not revoked by their providers.

GitHub's push protection and secret scanning features are effective at preventing new exposures and alerting users. However, credential providers must implement automated revocation pipelines to promptly disable leaked secrets. Organizations should ensure that exposed credentials are rotated and revoked immediately upon detection. Users should enable and monitor GitHub's secret scanning alerts and act on them by rotating keys. No urgent remediation is required for GitHub itself, as the platform's controls are in place; the focus should be on credential lifecycle management by providers and users.