Truffle Security finds 543,699 live credentials left public on GitHub for a median 784 days
Truffle Security scanned 224 million public GitHub repositories and found 543,699 credentials still working in July, exposed for a median 784 days. Push Protection screens only new pushes in known formats, so owners have to rotate the backlog themselves.
The Watch · Security desk
What happened
- GitHub's Push Protection scans incoming code for secret patterns and blocks the upload on a match, but it does not revoke credentials that were already public.
- Truffle counts 199,843 of the live credentials, about 36.8% of the total, as exposed after GitHub turned Push Protection on for all users in February 2024.
- More than half the working credentials, 51.8%, fall in categories the default Push Protection does not block, including database connection strings and Google API keys.
- Of 126,963 Google Cloud service account credentials found committed, 69,041 were still valid when Truffle ran its analysis.
- The scanned corpus was a dataset assembled to train large language models, built from a crawl that closed on August 7, 2025.
Why it matters
- What it limits constraint Roughly 343,856 live keys went public before February 2024, out of reach of a push-time gate; they stay usable until each owner rotates them.
- Who's exposed exposure An attacker who finds a committed Google Cloud service account key has better than even odds it works, with 54.4% of them still valid.
- Who has to decide decision Teams on GitHub's default settings have to run their own history scans for database connection strings and Google API keys, because the platform filter passes those formats.
Next story · Security · 3d ago
npm Trusted Publishing accepted a freed GitHub repo name as proof of who may publishConfirmed3 publishers
Push Protection checks commits as they arrive. A key that was already public when the check switched on stays public until someone rotates it, and it stays valid for the same period. Truffle's data holds a long tail of those. About 10% of the working credentials are older than 6.3 years, and the oldest dates from 2009 [3].
Within the patterns it recognises, the check has worked. Truffle measured a 53% fall in the rate of exposed credentials in protected categories after GitHub made the feature a default [13]. Applying the 51.8% share of uncovered categories to the full count gives roughly 282,000 working secrets in formats the default settings let through [20].
According to Truffle, the odds that a leaked credential gets revoked depend heavily on the issuing service [10]. Of 101,886 committed npm tokens, it found one that still worked [8]. Google Cloud went the other way. Its 69,041 live service account keys are 12.7% of every working credential in the study [19].
Secret density is rising. Working credentials per million files went from 3.72 in 2015 to a peak of 11.62 in 2025 [12], roughly a threefold increase [21]. The GitHub total is more than double the 221,303 working credentials Truffle found when it scanned Hugging Face in August [14].
Truffle counted each unique key once, but the keys appeared repeatedly, across more than 1.1 million files and repositories, forks included [22]. BleepingComputer's recommended response is to rotate exposed credentials immediately, clean up repositories, scan history and set automatic expiration for all active secrets [15]. Rotation acts on the key itself, so it covers every copy, including the ones in forks [22][15].
The research measures exposure. It does not show what share of these keys attackers have found or used [16].
What to watch
- Whether GitHub adds database connection strings and Google API keys to the patterns Push Protection blocks by default.
- Any report tying abuse to keys in this LLM training corpus, the share Truffle's study does not measure.
- A rescan showing how many of the 69,041 live Google Cloud service account keys get revoked after publication.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption50
- Hype gap+10
- Incentives
- Not scored
- Confidence64
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Truffle Security identified 543,699 unique credentials exposed in public GitHub repositories that were still valid in July, despite GitHub's measures to prevent accidental leaks.
- [2]
The median time a unique credential remained publicly accessible was 784 days.
- [3]
About 10% of the working credentials were older than 6.3 years, and the oldest dated from 2009.
- [4]
The data came from scanning 224 million repositories and more than 58 billion files.
- [5]
GitHub's Push Protection scans incoming code for secret patterns such as API keys and access tokens and blocks the upload if it detects one, but it does not revoke previously exposed credentials.
- [6]
199,843 of the credentials identified in July, roughly 36.8% of the total, were exposed after GitHub activated Push Protection for all users in February 2024.
- [7]
51.8% of the live credentials fell into categories that GitHub's default Push Protection does not block, including database connection strings and Google API keys.
- [8]
Of 101,886 committed npm tokens, the researchers found only 1 that still worked.
- [9]
Of 126,963 exposed Google Cloud service account credentials, 69,041 were still valid and working at the time of the analysis.
- [10]
Some credential types are much more likely to be revoked than others, depending on the service.
- [11]
The assessment was conducted on a dataset assembled to train large language models, based on a crawl that closed on August 7, 2025.
- [12]
Secret density increased over time, with working credentials rising from 3.72 per million files in 2015 to a peak of 11.62 in 2025.
- [13]
The rate of exposed credentials in protected categories fell by 53% after Push Protection was enabled by default.
- [14]
The number of exposed credentials on GitHub is more than double what Truffle found in August after scanning Hugging Face, where it detected 221,303 working credentials.
- [15]
The practical recommendation for those affected is to immediately rotate exposed credentials, clean up repositories, scan history, and set automatic expiration for all active secrets.
- [16]
Truffle's findings show the level and scale of working secret exposure on GitHub but do not reveal what percentage of those secrets are actually stolen and abused by attackers.
- [17]
About 343,856 of the live credentials were exposed before GitHub turned Push Protection on for all users in February 2024.
- [18]
54.4% of the committed Google Cloud service account credentials were still valid.
- [19]
Live Google Cloud service account keys are 12.7% of all working credentials in the study.
- [20]
Roughly 282,000 working credentials fall in categories default Push Protection does not block.
- [21]
Working-credential density rose roughly threefold between 2015 and 2025.
- [22]
The 543,699 unique credentials appeared repeatedly across more than 1.1 million files and repositories, including copies in forks.
Sources
2 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comOver 543,000 valid credentials exposed in public GitHub repositories
1 article · September 30, 2026
- securityweek.com500,000 Active Credentials Left Exposed on GitHub
1 article · October 1, 2026
Topics and entities
Topics
- Leaked secrets and credentials
- Secret Scanning
Entities
- GitHub Push Protection
- MongoDB
- Truffle Security
- npm registry
- Hugging Face
- Google Cloud
- GitHub