26,400 Valid Cloud & AI Credentials Exposed in Public Gitee Repositories
What Happened — An independent security researcher scanned 7.25 million public repositories on Gitee, a Chinese code‑hosting platform, and identified 26,400 credentials that were still active at the time of testing. The secrets included API keys, access tokens, and service‑account credentials for major cloud providers (AWS, Azure, GCP) and AI platforms (OpenAI, Anthropic, etc.). Because the repositories were publicly accessible, anyone could have copied a credential and gained unauthorised access to the associated services. The findings were disclosed on 28 October 2026; no confirmed abuse has been reported yet, but the exposure represents a clear breach of credential hygiene.
Why It Matters for Trust & Control Assurance — The leak highlights a failure in the credential‑management control objective; continuous secret‑scanning and strict access‑control policies are essential to provide defensible audit evidence.
Who Is Affected — Cloud‑service users, AI development teams, SaaS providers, and any organisation that stores code in public repositories.
Recommended Actions
- Immediately rotate all exposed keys and revoke any that may have been compromised.
- Deploy automated secret‑detection tools in CI/CD pipelines and repository hosting services.
- Enforce least‑privilege and short‑lived token policies for cloud and AI service accounts.
- Maintain an up‑to‑date inventory of active credentials and evidence of rotation for audit readiness.
Technical Notes — Attack vector: misconfiguration / secret leakage via publicly visible code. Data types: cloud provider API keys, AI platform access tokens, service‑account credentials. No specific CVE applies. Source: The Hacker News