# Truffle Security finds 543,699 active credentials exposed on GitHub

> **Key takeaway:** A scan of 224 million public GitHub repositories found over half a million still-valid leaked credentials, some exposed for more than 16 years.

**Published:** 2026-10-21T07:02:09+00:00 
**Source:** Linux Today 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/truffle-security-finds-543699-active-credentials-exposed-on-.html 

## Summary
Truffle Security researchers discovered 543,699 active credentials across more than 224 million public GitHub repositories. Some of these credentials have been publicly exposed for over 16 years. The findings indicate ongoing gaps in secret detection and removal practices on the platform.

## Scope of the credential exposure
- **543,699 credentials** verified as still active
- Scan covered **224+ million public repositories**
- Some credentials exposed for **over 16 years**
- Source: Truffle Security research

## Why it matters
The scale of valid leaked credentials poses risks for supply-chain attacks and unauthorized access to services integrated with open-source projects. Long-lived exposures suggest that automated secret scanning and developer education remain insufficient across the GitHub ecosystem.