GitHub repos expose over 543,000 still-valid credentials
Public GitHub repositories still hold hundreds of thousands of working secrets, even though the platform has added tools meant to stop accidental leaks. A new analysis by Truffle Security found 543,699 unique credentials that were still valid in July.
The researchers scanned 224 million repositories and more than 58 billion files. They found that a typical leaked credential stayed publicly accessible for a median of 784 days before anyone noticed or acted.
The age of some of these secrets is notable. About 10% of the working credentials were older than 6.3 years, and the oldest valid one dates back to 2009. The 543,699 unique secrets appeared again and again across more than 1.1 million files and repositories, including copies in forks.