500,000 Active Credentials Left Exposed on GitHub
Over 500,000 active credentials found exposed on public GitHub repositories.
Truffle Security discovered over 543,000 active credentials in public GitHub repositories, with many pushed even after GitHub enabled default push protections. The credentials, including Google Cloud service account credentials and MongoDB connection strings, remain active due to a lack of mandatory revocation by providers.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Truffle Security?
Get an email when a new story names Truffle Security, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonDevelopers inadvertently pushed sensitive credentials — including Google Cloud service account keys and MongoDB connection strings — into public GitHub repositories, leaving them discoverable by anyone. Even after GitHub introduced default push protection controls, thousands of secrets continued to be exposed, suggesting developers bypassed or ignored the safeguards. The credentials remained active because neither developers nor service providers enforced mandatory revocation upon discovery. This matters because exposed credentials are a direct pathway for attackers to access cloud infrastructure, databases, and sensitive data at scale, often within minutes of a secret being posted publicly.
What helps against this
How we list vendors- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.