An independent researcher has uncovered 26,400 valid credentials for cloud and AI services sitting exposed in public repositories on Gitee, a widely used Chinese code-hosting platform. The credentials were not just leaked, they were confirmed to still work at the time of testing, meaning anyone who stumbled across the code could have used them to access the associated accounts and services.

Researcher Ben Zimmermann conducted the scan across 7.25 million public Gitee repositories and reported the findings on October 28. The majority of the exposed secrets were keys tied to cloud infrastructure and AI service providers, reflecting the growing reliance on API-driven cloud and AI tooling in modern development workflows.

Why This Keeps Happening

Hardcoded credentials in source code remain one of the most persistent and preventable security failures in software development. Developers often embed API keys, access tokens, or service credentials directly into code during testing or prototyping, then forget to remove them before pushing to a public repository. Once published, these secrets are effectively public information, scrapeable by automated tools, researchers, and attackers alike.

The scale of this discovery, over 26,000 working credentials from a single platform, underscores how widespread the problem remains even as awareness of secrets management has grown across the industry. Cloud and AI provider keys are particularly valuable to attackers because they can enable unauthorized compute usage, data access, model abuse, or lateral movement into connected infrastructure, often racking up significant costs before the owner notices.

What Organizations Should Do

  • Audit public and private repositories for hardcoded secrets using automated scanning tools
  • Rotate any credentials that may have been exposed in code history, not just the current branch
  • Enforce secrets management solutions (vaults, environment variables, short-lived tokens) instead of embedding keys in code
  • Enable pre-commit hooks and CI/CD pipeline checks to catch secrets before they reach public repositories
  • Monitor cloud and AI service accounts for unusual usage patterns that could indicate credential abuse

This finding serves as a reminder that credential hygiene failures are not confined to any single platform or region. As AI services proliferate and developers integrate more third-party APIs into their projects, the attack surface for exposed secrets continues to expand.