Do Son 
Image: Ben Zimmermann
Independent security researcher Ben Zimmermann recently completed a massive audit of Gitee, China’s largest Git repository hosting platform. Specifically, the investigation examined public code repositories for lingering authentication secrets. The exhaustive scan scrutinized 7.25 million repositories and uncovered 26,000 valid, live private credentials. Furthermore, these leaked secrets expose critical accounts across Alibaba Cloud, DeepSeek, OpenAI, and Zhipu AI.
Staggering Volume of Cloud and AI Authentication Keys
To establish precise exposure metrics, the researcher utilized open-source scanning utilities to parse public repositories. Moreover, the scanner validated every prospective credential against upstream provider endpoints to confirm active status. The final tally eliminated duplicates to reflect unique secrets accurately. As detailed in the technical research report on Gitee repository secrets, cloud and artificial intelligence platforms suffered extensive exposure.
Alibaba Cloud experienced the heaviest exposure, accounting for 9,473 verified access keys. Meanwhile, artificial intelligence providers faced substantial credential leakage as well. The scan uncovered 3,170 operational API keys for DeepSeek, alongside 1,489 keys for Zhipu AI. Similarly, OpenAI lost 1,348 valid API keys across public projects. Additionally, the audit uncovered 3,805 YouTube tokens, 600 GitHub tokens, 338 AWS credentials, and 220 MongoDB keys. Alarmingly, the discovery included master administrator credentials for a prominent enterprise AI platform.
Persistent Git Histories and Hardcoded Secrets
Most exposures originated from simple developer oversights rather than intentional disclosures. Developers frequently commit hardcoded access tokens during rapid development sprints. Because Git preserves historical commits permanently, removing an active key from modern files fails to purge past revisions. In fact, approximately 50 percent of the verified keys dated back to commits pushed throughout 2025. Consequently, outdated repository snapshots remain a fertile hunting ground for malicious reconnaissance.
Provider Notification and Developer Remediation Steps
Following the discovery, the researcher dispatched detailed reports to affected cloud and software providers. These disclosures provided specific token details and repository references to facilitate rapid customer credential revocation. However, the sheer volume of leaked secrets prevented direct outreach to individual developers. Therefore, software engineers should audit their public Gitee repositories immediately. Organizations must rotate exposed authentication tokens, purge historical commit logs, and implement automated secret scanning before deploying software.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
