INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Gitee Repositories Expose 26,400 Valid Cloud and AI Credentials

| 2026-10-29 11:33 HIGH LOW DATA BREACH
JSON
Executive Summary
AI-generated
On October 28, an independent researcher discovered that approximately 26,400 valid cloud and AI credentials were exposed in public Gitee repositories. The identified entity behind the incident is Ben Zimmermann, a researcher who scanned over 7.25 million public Gitee repositories to find these credentials. These affected entities include developers from various countries, with the majority of keys belonging to Alibaba Cloud users, followed by YouTube API key holders and OpenAI account owners. The attack works by scanning each repository's full commit history using secret scanners TruffleHog and Kingfisher, which then try each credential against its respective service. As a result, many developers who left their credentials in public code on Gitee may have inadvertently exposed sensitive information that could be used without consent.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
NORTH_AMERICA NORTH_AMERICA
Incident Timeline
‎October 28
An independent researcher discovered 26,400 valid cloud and AI credentials exposed in public Gitee repositories by scanning 7.25 million of them on October 28.
organisation Independent
Independent researcher Ben Zimmermann found them by scanning 7.25 million public Gitee repositories and reported the results on October 28.
general_metric 7.25 Gitee repositories
Independent researcher Ben Zimmermann found them by scanning 7.25 million public Gitee repositories and reported the results on October 28.
‎the late 2000s
Threat actors used outdated cloud and AI credentials stored in public Gitee repositories dating back to the late 2000s.
‎2026/10/29
TruffleHog found 12,737 valid cloud and AI credentials in public Gitee repositories.
organisation Ministry of Industry and Information Technology
Gitee and Other Code Hosts China's Ministry of Industry and Information Technology chose Gitee in 2020 as the base for a national open-source code-hosting platform.
organisation Gitee
26,400 credentials that developers left in public code on Gitee , a Chinese code-hosting service, still worked when a researcher tested them.
data_breach 26,400 credentials
26,400 credentials that developers left in public code on Gitee , a Chinese code-hosting service, still worked when a researcher tested them.
organisation AccessKey
Most were keys for cloud and AI services, led by 9,473 Alibaba Cloud AccessKey pairs.
organisation BigModel AI
What Was Exposed After the Alibaba Cloud keys, the largest groups were 3,805 YouTube API keys, 3,170 DeepSeek keys, 1,489 keys for Zhipu's BigModel AI platform, and 1,348 OpenAI keys.
organisation GitHub
Smaller numbers were found for GitHub, AWS, Google Cloud and Google's Gemini.
organisation AWS
Smaller numbers were found for GitHub, AWS, Google Cloud and Google's Gemini.
organisation Google
Smaller numbers were found for GitHub, AWS, Google Cloud and Google's Gemini.
organisation API
That can cause "data loss, unexpected charges," a used-up monthly quota, and interrupted API access.
organisation TruffleHog
Deleting a key from the code or rewriting the repository's history does not revoke it , as noted by TruffleHog's maker, Truffle Security.
organisation Truffle Security
Deleting a key from the code or rewriting the repository's history does not revoke it , as noted by TruffleHog's maker, Truffle Security.
organisation ActionTrail
ActionTrail shows the key's API calls for the last 90 days, but data operations in services such as OSS and SLS have to be checked in each service's own logs.
organisation OSS
ActionTrail shows the key's API calls for the last 90 days, but data operations in services such as OSS and SLS have to be checked in each service's own logs.
organisation SLS
ActionTrail shows the key's API calls for the last 90 days, but data operations in services such as OSS and SLS have to be checked in each service's own logs.
organisation OpenAI
OpenAI: rotate the key immediately from the API Keys page, as OpenAI advises , and set spend limits to help limit charges from a leaked key.
organisation Zimmermann
Two Scanners, Different Results MongoDB makes Kingfisher, and Zimmermann's post was developed with its Kingfisher team.
organisation Teams
Teams that rely on a single scanner should verify its detectors against the services they use.
organisation Gitee's
Gitee's public API is limited, and a 2021 attempt to study leaked credentials on the site gave up because of it.
organisation GitLab
Gitee's rate, 3.64 working credentials per 1,000 repositories scanned, is higher than the rates from earlier scans of GitLab (3.11) and Bitbucket (2.39).
data_breach 3.64 working credentials
Gitee's rate, 3.64 working credentials per 1,000 repositories scanned, is higher than the rates from earlier scans of GitLab (3.11) and Bitbucket (2.39).
data_breach 2.39 Bitbucket
Gitee's rate, 3.64 working credentials per 1,000 repositories scanned, is higher than the rates from earlier scans of GitLab (3.11) and Bitbucket (2.39).
data_breach 12,737 credentials
In this scan, TruffleHog found 12,737 credentials that worked, and Kingfisher found 14,664, but only 1,001 were found by both.
Tactical Metrics
Metrics
data_breach
26,400
Credentials
26,400 credentials that developers left in public code on Gitee , a Chinese code-hosting service, still worked when a researcher tested them.
Metrics
data_breach
4
Working Credentials
Gitee's rate, 3.64 working credentials per 1,000 repositories scanned, is higher than the rates from earlier scans of GitLab (3.11) and Bitbucket (2.39).
Metrics
data_breach
2
Bitbucket
Gitee's rate, 3.64 working credentials per 1,000 repositories scanned, is higher than the rates from earlier scans of GitLab (3.11) and Bitbucket (2.39).
Metrics
data_breach
12,737
Credentials
In this scan, TruffleHog found 12,737 credentials that worked, and Kingfisher found 14,664, but only 1,001 were found by both.
Intelligence Sources
The Hacker News 2026-10-29