● Covered by 1 source · 1 reportMedium impact1 negative
26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories
Key points
- 26,400 active credentials found in public Gitee repositories.
- Credentials included keys for Alibaba Cloud, YouTube, DeepSeek, Zhipu, OpenAI.
- Researcher notified vendors, but not individual developers.
- Keys from 2025 and earlier were still active.
Credential Exposure Discovery
Independent researcher Ben Zimmermann identified 26,400 active cloud and AI credentials exposed in public Gitee repositories. The discovery was made by scanning 7.25 million public Gitee repositories, a Chinese code-hosting service. The credentials were confirmed to be functional at the time of testing.
Methodology and Scope
Zimmermann used two secret scanners, TruffleHog and Kingfisher, to analyze each repository's full commit history. These tools tested each credential against its issuing service, retaining only those that were still valid. The 26,400 figure represents unique credentials, regardless of how many repositories they appeared in. Nearly half of these credentials, 12,242, were dated to 2025 by commit date, with some dating back to the late 2000s.
Affected Services
The exposed credentials primarily belonged to cloud and AI services. The largest groups included 9,473 Alibaba Cloud AccessKey pairs, 3,805 YouTube API keys, 3,170 DeepSeek keys, 1,489 keys for Zhipu's BigModel AI platform, and 1,348 OpenAI keys. Smaller numbers were also found for GitHub, AWS, Google Cloud, and Google's Gemini. One credential was an active organization-admin credential for an unnamed major enterprise AI platform.
Implications of Compromise
The impact of a compromised key varies by service. OpenAI states that a compromised key can lead to unauthorized usage of an account's quota, resulting in data loss, unexpected charges, depleted monthly quotas, and interrupted API access. Google indicates that a YouTube API key, which is a Google Cloud API key, could be used with any API that accepts Google Cloud keys if API restrictions are not in place.
Recommendations for Developers
Zimmermann provided a list of exposed credentials to the respective vendors but did not contact individual developers. As of his publication, there was no confirmation that any of the reported credentials had been revoked. Developers who have ever committed a key to a public Gitee repository should assume that key is compromised and take appropriate action, such as revocation and rotation.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
A researcher discovered 26,400 active cloud and AI service credentials exposed in public Gitee repositories, which were still functional when tested. These credentials, including keys for Alibaba Cloud, YouTube API, DeepSeek, Zhipu, and OpenAI, could allow unauthorized access and potential misuse of services. Developers who have committed keys to public Gitee repositories should consider them compromised.