[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEFO0PoiGsiUbe39kRyZHepU3IOZnsveuVWhqytOPh4s":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"2f44b3b2-600a-4a92-8bdb-f9c5ab12d355","543000-valid-credentials-exposed-in-public-github-repos-for-over-2-years","762ca798-fc3f-402e-b4fd-7b8b31674a52","543,000+ Valid Credentials Exposed in Public GitHub Repos for Over 2 Years","Developers routinely commit API keys, database connection strings, and other secrets directly into public GitHub repositories, often unknowingly or out of convenience. With a median exposure time of 784 days, these credentials remain exploitable long after initial exposure, giving attackers ample time to harvest and abuse them. GitHub's Push Protection feature, while helpful, does not block all secret types by default, leaving significant gaps in automated defenses. This incident underscores that technical controls alone are insufficient — developers must understand why hardcoding credentials is dangerous and organizations must enforce secrets management practices systematically.","**Immediate actions:**\n- Scan all public and private repositories immediately using tools like TruffleHog, GitGuardian, or GitHub's secret scanning to identify exposed credentials.\n- Rotate every identified credential without delay, treating all exposed secrets as fully compromised regardless of apparent usage.\n- Revoke and regenerate API keys, database passwords, and tokens found in repositories before attempting any cleanup.\n\n**Long-term improvements:**\n- Enforce organization-wide use of secrets management solutions (e.g., HashiCorp Vault, AWS Secrets Manager) so credentials are never stored in source code.\n- Enable and configure GitHub Push Protection for all secret types, including custom patterns relevant to your environment.\n- Embed pre-commit hooks (e.g., detect-secrets, git-secrets) into developer workflows to block secret commits before they reach the repository.\n\n**Detection & monitoring measures:**\n- Integrate continuous secrets scanning into the CI\u002FCD pipeline to automatically flag and fail builds containing exposed credentials.\n- Set up real-time alerting on credential usage anomalies (e.g., API keys used from unexpected geographies or at unusual volumes) via your SIEM or cloud provider.\n- Conduct periodic developer training on secure coding practices, with specific focus on secrets handling and the risks of credential exposure.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 3.11 – Encrypt Sensitive Data at Rest","CIS Control 4.7 – Manage Default Accounts","CIS Control 14 – Security Awareness and Skills Training","NIST SP 800-53 IA-5 – Authenticator Management","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 SA-15 – Development Process, Standards, and Tools","NIST SP 800-57 – Key Management Guidelines","GDPR Article 32 – Security of Processing","OWASP A07:2021 – Identification and Authentication Failures","ITIL – Information Security Management (Credential Lifecycle)",{},"published","2026-09-30T20:21:01.145857+00:00","2026-09-30T20:21:00.802+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fover-543-000-valid-credentials-exposed-in-public-github-repositories\u002F","over-543-000-valid-credentials-exposed-in-public-github-repositories-2ebaae","Over 543,000 valid credentials exposed in public GitHub repositories",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":44,"name":45,"slug":46,"description":47,"color":48},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[51,55,59],{"slug":52,"name":53,"problem":54},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":56,"name":57,"problem":58},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":60,"name":61,"problem":62},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]