Do Son 
At a glance
| Organization | Multiple organizations worldwide |
| Data Exposed | AWS keys, Stripe secrets, GitHub tokens, internal records |
| Affected Count | 28,000 repositories across 3.5 million hosts |
| Cause | Publicly exposed .git directory misconfiguration |
| Disclosure Status | Public security research report |
| Source | Intruder Research |
Security researchers discovered over 28,000 exposed Git repositories across 3.5 million active web servers. These misconfigured repositories exposed live AWS keys, Stripe payment secrets, and private internal records. Consequently, organizations face serious risks of cloud infrastructure takeover and data theft.
What Was Exposed
The scan uncovered thousands of valid authentication tokens and sensitive documents. Specifically, researchers recovered over 400 AWS access keys and 107 live Stripe secret keys. In addition, the team retrieved 123 OpenAI keys, 80 Telegram tokens, and 17 GitHub personal access tokens.
These leaked credentials gave direct access to internal cloud storage buckets. In one instance, AWS keys exposed employee attendance records and disciplinary files. Furthermore, live Stripe keys exposed transaction histories, payout schedules, and partial bank account numbers.
How the Exposure Happened
The issue stems from basic web server configuration errors. Administrators accidentally left the .git folder accessible through public web roots. To analyze these flaws, Intruder developed an open-source tool named gitreaper.
The tool inspects repository commits in system memory without saving whole codebases. The researchers explained that “walking the entire history rather than just the latest HEAD state means we still catch secrets in files that were removed in later commits.” As a result, developers who deleted credentials in subsequent commits remained vulnerable.
Who Is Affected
This data exposure affects thousands of companies running exposed Git repositories on public servers. Intruder scanned 3.5 million active hosts and detected 28,000 open repositories. However, researchers have not confirmed the exact number of compromised individual users. Many active keys belonged to development, administrative, and staging environments.
Recommended Mitigation Steps
Security teams must audit their web servers immediately to eliminate exposed Git repositories. First, block public HTTP access to the .git directory across all web servers. Next, rotate all exposed API keys, access tokens, and passwords immediately. Finally, implement automated secret scanning in your continuous integration pipelines.
Researcher Findings and Industry Response
According to the Intruder research report, “exposed git repositories remain a widespread, unsolved problem.” The team confirmed that “Many of the credentials we extracted were still active at the time of testing.” Organizations must adopt stricter deployment checks to stop sensitive credential leaks before they reach public servers.
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
