26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories

Summary: Independent researcher Ben Zimmermann scanned 7.25 million public Gitee repositories and found 26,400 credentials that still worked when tested against their issuing services, led by 9,473 Alibaba Cloud AccessKey pairs, 3,805 YouTube API keys, 3,170 DeepSeek keys, 1,489 Zhipu BigModel keys and 1,348 OpenAI keys. He reported the results on October 28 and had not confirmed that any of the credentials had been revoked when he published.
Why it matters: One of the working credentials was an active organization-admin credential for a major enterprise AI platform, and 12,242 of the 26,400 came from 2025 commits - so keys pushed to public code this year are still live at the provider until someone revokes them.

Read the original at The Hacker News ↗