GitHub threat report

Security researchers identified 543,699 active credentials exposed in public GitHub repositories, many remaining valid for years despite being publicly accessible since 2009. The study reveals that GitHub's push protection controls, introduced in February 2024, prevent some leaks but fail to block over half of credential types including database strings, private keys, and Google API keys. Analysis shows issuer-side revocation is the primary factor in limiting exposure; credential survival varies widely depending on the service, with 88% of PostgreSQL URIs and 54% of Google Cloud keys remaining live.

• Researchers Find 543,699 Active Credentials Leaked in Public Git(opens in a new tab)