26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories
Independent researcher Ben Zimmermann scanned 7.25 million public repositories on Gitee and discovered 26,400 active, verified credentials including Alibaba Cloud keys, DeepSeek keys, OpenAI keys, and
Affiliate disclosure: We may earn a commission from qualifying purchases through these links at no additional cost to you. As an Amazon Associate I earn from qualifying purchases.
26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories
What the research found
Independent researcher Ben Zimmermann scanned 7.25 million public repositories on Gitee and found 26,400 active, verified credentials that remained valid after testing, according to The Hacker News (2026-10-29). The exposed secrets included Alibaba Cloud AccessKey pairs, DeepSeek keys, OpenAI keys, AWS credentials, and other tokens tied to major cloud and AI services.
The largest single group was 9,473 Alibaba Cloud AccessKey pairs, followed by 3,805 YouTube API keys, 3,170 DeepSeek keys, 1,489 keys for Zhipu’s BigModel AI platform, and 1,348 OpenAI keys, with additional credentials for AWS, Google Cloud, GitHub, and Google’s Gemini, The Hacker News reported (2026-10-29).
Why the exposure matters
According to the source report, these kinds of credentials can give attackers access to sensitive data, allow unauthorized charges, or let them hijack compute resources if they are left active and reachable in public code repositories (The Hacker News, 2026-10-29).
That risk is especially relevant when the credentials are still valid. In this case, the researcher reportedly tested the secrets and confirmed they worked, which makes the exposure more than a theoretical leak (The Hacker News, 2026-10-29).
Gitee’s leakage rate compared with other platforms
The report says Gitee showed a higher leakage rate than GitLab or Bitbucket, with 3.64 working credentials per 1,000 repositories on Gitee, compared with 3.11 on GitLab and 2.39 on Bitbucket (The Hacker News, 2026-10-29).
That comparison suggests secret exposure is not limited to one platform, but the report’s numbers indicate Gitee had the highest rate among the three in this study. The source does not establish why the difference exists, only that it was observed in Zimmermann’s scan (The Hacker News, 2026-10-29).
What developers should do
The report says deleting code or rewriting commit history is not enough to remove the risk, because exposed secrets can remain usable even after they are removed from public view. Developers need to revoke and rotate credentials directly at the provider level, rather than assuming repository cleanup solves the problem (The Hacker News, 2026-10-29).
That guidance is straightforward: if a key may have been exposed, treat it as compromised until it has been replaced.
Conclusion
This finding is another reminder that public code repositories can become a large-scale source of live secrets. The key point is not just that credentials were present in Gitee history, but that thousands of them were still active when tested. For cloud and AI teams, the practical response is immediate revocation, rotation, and stronger secret-scanning practices before code is pushed publicly (The Hacker News, 2026-10-29).
Sources and dates
Research completed: 2026-11-01T05:17:03Z
Affiliate link: we may earn a commission at no additional cost to you. Check current features and terms before signing up.
Building your own website?
This separate resource is for readers creating an online business: Explore Systeme.io. It is an affiliate link, not an Amazon product recommendation.
This article may contain affiliate links. If you purchase through them, we may earn a commission at no additional cost to you.