Truffle Security finds 543,699 active credentials exposed on GitHub
A scan of 224 million public GitHub repositories found over half a million still-valid leaked credentials, some exposed for more than 16 years.
Summary
Truffle Security researchers discovered 543,699 active credentials across more than 224 million public GitHub repositories. Some of these credentials have been publicly exposed for over 16 years. The findings indicate ongoing gaps in secret detection and removal practices on the platform.
Scope of the credential exposure
- 543,699 credentials verified as still active
- Scan covered 224+ million public repositories
- Some credentials exposed for over 16 years
- Source: Truffle Security research
Why it matters
The scale of valid leaked credentials poses risks for supply-chain attacks and unauthorized access to services integrated with open-source projects. Long-lived exposures suggest that automated secret scanning and developer education remain insufficient across the GitHub ecosystem.
Original reference: www.linuxtoday.com →