Research by Truffle Security analyzed 224 million GitHub repositories and over 58 billion files, identifying 543,699 unique credentials repeatedly exposed across more than 1.1 million files and repositories. Despite GitHub's Push Protection feature scanning for secret patterns and blocking uploads, many credentials remain valid and publicly accessible. Approximately 36.8% of exposed credentials were committed after Push Protection was enabled for all users, and over half of the live credentials fall into categories not covered by Push Protection, such as database connection strings and Google API keys. Credential revocation rates vary by service; for example, npm tokens are mostly revoked, while many Google Cloud service account credentials remain active. The study highlights the ongoing risk of credential exposure on GitHub and recommends immediate rotation and cleanup of exposed secrets.

The exposure of valid credentials in public repositories can lead to unauthorized access to services, data breaches, and potential misuse of cloud resources or APIs. The long median exposure time increases the window of opportunity for attackers. Although GitHub's Push Protection reduces new exposures in covered categories, it does not revoke existing credentials or cover all secret types, leaving many credentials vulnerable. The impact varies by credential type and service, with some credentials more likely to be revoked than others.

Affected users and organizations should immediately rotate any exposed credentials, clean up repositories and their histories to remove secrets, and implement automatic expiration policies for active secrets. GitHub's Push Protection helps prevent new exposures for certain secret types but does not revoke existing credentials, so manual remediation is necessary. Regular scanning for exposed secrets and prompt response remain critical.