Gitee scan finds 26,400 live credentials across 7.25 million repositories
Independent researcher Ben Zimmermann says his month-long scan combined two secret scanners and a workaround for Gitee's limited public API.
By Ryan Merket · Published
Primary source: Hacker News
Why it matters
The scan shows how much credential exposure can sit in public Git history, including keys that still authenticate. Its value will ultimately depend on whether vendors can identify affected accounts and revoke the credentials.
Independent security researcher Ben Zimmermann says he found 26,400 unique credentials that still authenticated while scanning 7,256,531 public repositories on Gitee, China's largest indigenous Git-hosting platform. His report on MongoDB's site, published on October 28th, 2026, describes a month-long effort built to work around Gitee's limited public API.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.