26,400 live cloud and AI keys found in public Gitee repositories, led by Alibaba Cloud, DeepSeek and OpenAI
Gitee public repositories (leaked cloud and AI API keys)
A researcher scanned 7.25 million public repositories on Gitee, China's largest Git host, and found 26,400 unique credentials that still worked: 9,473 Alibaba Cloud AccessKey pairs, 3,805 YouTube API keys, 3,170 DeepSeek keys, 1,489 Zhipu BigModel keys, 1,348 OpenAI keys and more, including an organization-admin key for an unnamed enterprise AI platform. Gitee has no public secret-scanning partnerships with vendors, and no revocations were confirmed at publication. Anyone who ever pushed a key to a public Gitee repo should treat it as exposed and revoke it.
Why this severity: Large exposure of working keys; no confirmed abuse reported, and the researcher did not say whether anyone else used them
- Started
- Oct 28, 2026
Affected
- Any cloud or AI API key ever committed to a public Gitee repository, including keys later deleted from the code (they stay in commit history)
Fixed in
No fixed release yet
Timeline2
The Hacker News reports the breakdown: 9,473 Alibaba Cloud AccessKey pairs, 3,805 YouTube API keys, 3,170 DeepSeek keys, 1,489 Zhipu BigModel keys and 1,348 OpenAI keys, plus smaller numbers for GitHub, AWS, Google Cloud and Gemini. Nearly half (12,242) came from 2025 commits. Zimmermann sent lists to the vendors with the most exposed keys but did not contact the developers, and had not confirmed any revocations when he published.
Independent researcher Ben Zimmermann publishes a month-long scan of 7,256,531 public Gitee repositories with TruffleHog and Kingfisher: 26,400 unique credentials still authenticated at scan time, including an active organization-admin credential for an unnamed enterprise AI platform. Gitee had a higher rate (3.64 per 1,000 repos) than comparable scans of GitLab (3.11) and Bitbucket (2.39).
News & write-ups3
- Scanning 7.25 Million Public Repositories on China's Largest Git Platform for SecretsMongoDB · Oct 28, 2026 · Write-up
- 26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee RepositoriesThe Hacker News · Oct 29, 2026
- Scanning 7.25M Public Repositories on China's Largest Git Platform for SecretsHacker News · Oct 29, 2026
Notes & caveats
Research finding, not an attack on Gitee itself. Gitee has not commented. patchStatus partial: the researcher notified the largest affected vendors, but no revocations were confirmed when he published. MongoDB makes Kingfisher and co-developed the post.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
