26,400 live credentials found in 7.25 million public Gitee repositories
26,400 live credentials found scanning 7.25M repos on China's Gitee
An independent security researcher scanned 7,256,531 public repositories on Gitee, China's largest Git platform, using TruffleHog and Kingfisher together. The dual-scanner pipeline surfaced 26,400 unique, verified-live credentials, including an active org-admin key for a major enterprise AI platform and thousands of Alibaba Cloud access keys. Gitee's density of 3.64 live secrets per 1,000 repos exceeds comparable scans of GitLab and Bitbucket. The month-long scan cost about $3,100 and relied on workarounds for Gitee's limited APIs and a 200-result search cap.
Either scanner alone would have caught only about half of these credentials.
- gosen
Surprised the gap is that small! 3.64 vs 3.11 per 1k repos
I'd have expected Gitee to be way worse with no scanning partnerships at all..
would be curious to see GitHub in that table, to know how much push protection actually changes that number
- nitroedge
So what happens if someone uses some of these credentials and enjoys free AI for as long as they are active? Just curious if this is is criminally enforced now and what the penalties have been?
I remember there was a site awhile ago that listed Ollama instances which were made open to the public and had the # of tokens/sec throughput beside each one.
- dorianmariecom
same on github or gitlab etc