# 26,400 working cloud and AI credentials found in public Gitee repositories

Source: https://startwithidentity.com/blog/2026-10-28-26400-working-cloud-and-ai-credentials-found-in-public-gitee-repositories/
Last updated: 2026-10-28
License: content by Start with Identity. Cite the source URL.

---

Independent researcher Ben Zimmermann scanned 7,256,531 public repositories on Gitee, China's largest Git hosting platform, and found 26,400 unique credentials that still worked when tested, he wrote on MongoDB's engineering blog on October 28. He ran two secret scanners, TruffleHog and Kingfisher, over each repository's full commit history and kept only credentials the issuing service accepted. Alibaba Cloud access keys were the largest group, and AI provider keys from DeepSeek, OpenAI and Zhipu followed in the thousands. One finding was "an active organization-admin credential for a major enterprise AI platform." The scanners overlapped on only 1,001 credentials, so either tool alone would have caught about half; Kingfisher found all 1,489 Zhipu keys, which TruffleHog has no detector for. Zimmermann sent the most exposed vendors their lists but did not contact individual developers.

## Why it matters

The scan read commit history, so a key a developer later deleted from the code still counted. Deleting a secret is not revoking it, the same lesson as [LiteLLM's admin key](https://startwithidentity.com/blog/2026-10-23-litellm-traces-poisoned-release-to-an-admin-key-leaked-in-may-and-never-revoked/), which was removed from a public repository within hours and still worked months later. A live AI provider key in a public repository is a direct line to someone else's bill, which is what [LLMjacking](https://startwithidentity.com/glossary/llmjacking/) runs on.

If a key ever reached a public repository on any platform, revoke it at the provider and issue a new one; rewriting history does not help. Run more than one scanner, since detector coverage differs by vendor, and restrict cloud keys to the APIs they need. The technique page is [secrets in repositories and CI](https://startwithidentity.com/techniques/secrets-in-repositories-and-ci/), and our [secrets management guide](https://startwithidentity.com/guides/fundamentals/what-is-secrets-management/) covers replacing long-lived keys with short-lived credentials.

Source: [MongoDB Engineering Blog](https://www.mongodb.com/company/blog/technical/scanning-7-point-25-million-public-repositories-chinas-largest-git-platform-for-secrets)