[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVjDChJAdv5Zmh5SKgHOi-gzOFNb7s1AZkB5aEI56B-c":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"a699c06e-de10-4766-95f1-620791aecf3d","500000-active-credentials-exposed-in-public-github-repos","ab419a54-a0fe-4424-83f2-5718a25b5433","500,000 Active Credentials Exposed in Public GitHub Repos","Developers inadvertently pushed sensitive credentials — including Google Cloud service account keys and MongoDB connection strings — into public GitHub repositories, leaving them discoverable by anyone. Even after GitHub introduced default push protection controls, thousands of secrets continued to be exposed, suggesting developers bypassed or ignored the safeguards. The credentials remained active because neither developers nor service providers enforced mandatory revocation upon discovery. This matters because exposed credentials are a direct pathway for attackers to access cloud infrastructure, databases, and sensitive data at scale, often within minutes of a secret being posted publicly.","**Immediate actions:**\n- Audit all public and private repositories now using secret scanning tools (e.g., Trufflehog, GitHub Advanced Security) and revoke any discovered credentials immediately.\n- Rotate all potentially exposed API keys, service account credentials, and connection strings as an emergency measure, even if exposure is unconfirmed.\n\n**Long-term improvements:**\n- Enforce pre-commit hooks (e.g., git-secrets, detect-secrets) in developer pipelines to block credential commits before they reach any remote repository.\n- Implement a secrets management solution (e.g., HashiCorp Vault, AWS Secrets Manager) so credentials are never stored in source code.\n- Establish a mandatory developer training program covering secure coding practices, with specific focus on credential and secrets hygiene.\n\n**Detection & response measures:**\n- Enable GitHub's native push protection and secret scanning alerts organization-wide and configure them to block — not just warn — on detected secrets.\n- Set up continuous monitoring with automated alerts that trigger credential revocation workflows the moment a secret is detected in a public repository.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 3.11 – Encrypt Sensitive Data at Rest","CIS Control 4.7 – Manage Default Accounts on Enterprise Assets","CIS Control 14 – Security Awareness and Skills Training","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 IA-5 – Authenticator Management","NIST SP 800-53 SA-15 – Development Process, Standards, and Tools","NIST SP 800-57 – Key Management Guidelines","GDPR Article 32 – Security of Processing","OWASP Top 10 A02:2021 – Cryptographic Failures","ITIL – Information Security Management (Credential Lifecycle)",{},"published","2026-10-01T10:20:32.748312+00:00","2026-10-01T10:20:32.463+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.securityweek.com\u002F500000-active-credentials-left-exposed-on-github\u002F","500-000-active-credentials-left-exposed-on-github-471028","500,000 Active Credentials Left Exposed on GitHub",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":44,"name":45,"slug":46,"description":47,"color":48},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[51,55,59],{"slug":52,"name":53,"problem":54},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":56,"name":57,"problem":58},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":60,"name":61,"problem":62},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]