NewsPublished 30 Sep 2026

Over 543,000 valid credentials exposed in public GitHub repositories

Source Bleeping Computer

Description

Over 543,000 valid credentials were found exposed in public GitHub repositories as of July 2025, despite GitHub's security measures like Push Protection. These credentials include API keys, access tokens, database connection strings, and cloud service account credentials. The median exposure time for a unique credential was 784 days, with some credentials dating back to 2009. Push Protection, introduced in 2022 and enabled by default in 2024, has reduced exposure rates for certain credential types but does not revoke previously exposed secrets or cover all credential categories. The exposed credentials pose a risk if not rotated or revoked promptly.

Impact

The exposure of valid credentials in public repositories can lead to unauthorized access to services, data breaches, and potential misuse of cloud resources or APIs. The long median exposure time increases the window of opportunity for attackers. Although GitHub's Push Protection reduces new exposures in covered categories, it does not revoke existing credentials or cover all secret types, leaving many credentials vulnerable. The impact varies by credential type and service, with some credentials more likely to be revoked than others.

Defensive guidance

Affected users and organizations should immediately rotate any exposed credentials, clean up repositories and their histories to remove secrets, and implement automatic expiration policies for active secrets. GitHub's Push Protection helps prevent new exposures for certain secret types but does not revoke existing credentials, so manual remediation is necessary. Regular scanning for exposed secrets and prompt response remain critical.

Summary

Research by Truffle Security analyzed 224 million GitHub repositories and over 58 billion files, identifying 543,699 unique credentials repeatedly exposed across more than 1.1 million files and repositories. Despite GitHub's Push Protection feature scanning for secret patterns and blocking uploads, many credentials remain valid and publicly accessible. Approximately 36.8% of exposed credentials were committed after Push Protection was enabled for all users, and over half of the live credentials fall into categories not covered by Push Protection, such as database connection strings and Google API keys. Credential revocation rates vary by service; for example, npm tokens are mostly revoked, while many Google Cloud service account credentials remain active. The study highlights the ongoing risk of credential exposure on GitHub and recommends immediate rotation and cleanup of exposed secrets.

References

bleepingcomputer.com/news/security/over-543-000-valid-credentials-exposed-in-public-github-repositories/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 30 Sep 2026, 18:19 UTC

References

Community reviews