Gitee repositories expose 26,400 valid cloud and AI credentials

Independent researcher Ben Zimmermann discovered 26,400 valid cloud and AI credentials exposed in public repositories on Gitee, a Chinese code-hosting service. The credentials remained functional during testing, meaning anyone who copied them could have potentially accessed the associated services.

Zimmermann identified the leaks by scanning 7.25 million public repositories using secret scanners TruffleHog and Kingfisher. The analysis revealed that nearly half of the credentials, totaling 12,242, were from 2025, though some dated back to the late 2000s. The scanners examined full commit histories, meaning keys previously removed by developers were still detected.

The largest group of exposed credentials included 9,473 Alibaba Cloud AccessKey pairs. Other significant exposures included 3,805 YouTube API keys, 3,170 DeepSeek keys, 1,489 keys for Zhipu’s BigModel AI platform, and 1,348 OpenAI keys. Smaller numbers of keys were found for AWS, GitHub, Google Cloud, and Google’s Gemini. One discovered credential was described as an active organization-admin credential for a major enterprise AI platform.