26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories
- ID
- 40765
- Status
- summarized
- Published
- 29 Oct 2026, 7:33 PM
- Fetched
- 29 Oct 2026, 10:19 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/10/26400-valid-cloud-and-ai-credentials.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 6.5
- Created
- 29 Oct 2026, 10:19 PM
- Tags
- Audience
- developersvibe_codersai_ml_learnerssaas_founders
What happened
A scan of public repositories on the Gitee code-hosting platform turned up 26,400 credentials that were still valid, and the set includes cloud and AI service keys rather than only dead or placeholder strings. The article page as provided is mostly navigation boilerplate, so the write-up's methodology, the specific providers affected, and any remediation guidance are not available in the text.
Why it matters
The 'valid' part is the operative word: if your .env, notebook, or agent config with a model-provider or cloud key has ever been pushed to a public repo, this finding says assume the key still works for whoever scraped it — rotate it and check provider billing/usage logs for calls you didn't make, rather than assuming a deleted commit cleaned it up. The AI-credential portion is the newer risk: agent and LLM keys often have no spend cap, so a leaked one costs money before it trips any alarm.
Discussion angle
Run a secret scan over your own git history this week (including forks and old branches) and report back: how many live keys did you find, and do your AI provider keys have hard spend limits set? The count of 26,400 is only meaningful if we know how many of our own repos would contribute to it.