Gitee public code scan finds 26,400 live credentials across 7.25M repos

Key points

• Ben Zimmermann scanned Gitee's public code and found 26,400 sets of usable credentials.
• The review covered roughly 7.25 million repositories on the platform.
• Exposed secrets could be abused to access cloud and AI services.
• Findings were tested and reported on October 28; no CVE was assigned.

On October 28, researcher Ben Zimmermann disclosed the results of a broad review of code hosted publicly on Gitee. The work involved searching exposed projects for secrets, then checking whether the discovered values still worked. According to the findings, tens of thousands of credential sets remained valid, creating a realistic path for unauthorized access if they fell into the wrong hands.

The scale is notable: the review covered about 7.25 million repositories and identified 26,400 working credentials. Those secrets could belong to developers, teams, or organizations that use Gitee for collaboration. Because the exposed values may unlock cloud platforms and AI tools, the potential impact extends beyond the code repository itself and into connected infrastructure.

Public code hosting is not inherently unsafe, but accidental secret commits are a recurring problem across platforms. When credentials are committed and left in public view, attackers can collect them automatically and test them against related services. Zimmermann's approach—scanning, validating, and reporting—demonstrates how quickly this exposure can be confirmed at scale.

For K-12 and government teams, the lesson is to treat public repositories as an extension of the attack surface. Any token, key, or password that appears in source code should be considered compromised, even if the project is later made private. The absence of a CVE does not reduce the operational risk; this is a configuration and hygiene issue rather than a software vulnerability.

What to watch: organizations with Gitee presence should review repository visibility, secret-scanning coverage, and token permissions. Expect continued automated scanning of public code by researchers and attackers alike. Rapid revocation and rotation remain the most reliable containment measures when a secret is found.

What to do now

1. Immediately search Gitee and other code hosts for committed secrets, then revoke and rotate every confirmed or suspected credential.
2. Enable secret scanning and push protection where available, and add pre-commit hooks to block common key and token patterns.
3. Audit repository visibility and remove unnecessary public projects; restrict access to only the teams that need it.
4. Reduce token scope and lifetime for cloud and AI service integrations, and prefer short-lived credentials over long-lived keys.
5. Monitor cloud and AI service logs for unusual access that may indicate credential misuse, and alert on anomalies.
6. Train developers to avoid hard-coded secrets and provide an approved secrets-management workflow for local and CI use.

Original source

The Hacker News