Scan Finds 26,400 Working Cloud and AI Credentials in Public Gitee Repositories

Independent researcher Ben Zimmermann found 26,400 unique, working credentials in the full commit histories of 7.25 million public repositories on Gitee, China’s largest Git platform. The month-long scan exposed 9,473 Alibaba Cloud AccessKey pairs and thousands of keys for services including YouTube, DeepSeek, BigModel, and OpenAI. Some credentials had been exposed for years. Zimmermann used TruffleHog and Kingfisher, with limited overlap between their findings revealing substantial differences in service coverage.

Zimmermann notified vendors with the most exposed credentials but did not contact individual developers; no revocations had been confirmed when he published the findings on October 28. The reports do not establish malicious use of the credentials. Organizations using Gitee should revoke or rotate exposed credentials, review service activity and charges for unauthorized use, and restrict credential permissions. Checks should cover repository histories, not just current files, because deleting a secret from the latest version does not remove its earlier exposure.