Scan of 7.25M public Gitee repos verifies 26,400 live credentials

A one-person research project has verified 26,400 live credentials across the entire public surface of Gitee, China's largest homegrown Git hosting platform. Independent security researcher Ben Zimmermann, working with MongoDB's Kingfisher team, published the findings in a guest post on MongoDB's company blog after scanning 7,256,531 public repositories with two secret-detection tools running in parallel.

The haul included an active organization-admin credential for a major enterprise AI platform and thousands of working cloud provider access keys. Because both scanners authenticate each candidate against its vendor's API before counting it, everything in the dataset was confirmed usable at scan time rather than merely matching a pattern.

Why Gitee was an open target

Gitee, launched in 2013 by OSChina, was selected by China's Ministry of Industry and Information Technology as the country's national open-source code hosting platform. According to the blog post, it combines three properties that make credential leakage sticky: it is Git-based, so secrets buried in old commits persist indefinitely; it hosts millions of public repositories with active commit traffic; and it has no public equivalent of the secret-scanning partnerships that platform vendors have made standard on GitHub.

A 2021 attempt to study credential exposure on Gitee reportedly gave up because the APIs were too limited to scale. Zimmermann got around this by stitching together several surfaces.

Enumerating 7.25 million repositories

Gitee's public API offers no paginated project listing, and its on-site code search appears to have been retired years ago. Zimmermann instead built a corpus of 1,704,759 usernames by querying the one REST search endpoint that scales, firing three-character prefix queries from aaa through zzz, and supplementing the results with usernames harvested from the Explore feed, follow lists and stargazer pages.

He then scraped each user's repository and starred-project pages on the website itself. To reach repositories outside that social graph, he used the internal Elasticsearch endpoint behind Gitee's search widget. That endpoint silently truncates any query at 200 results, so he split capped queries along the language and license aggregation buckets the responses already returned, recursing into deeper prefixes until each branch fit under the cap. After deduplication this yielded 7,256,531 unique public repositories.

The scanning pipeline

The scan ran on Modal, a serverless compute platform, as a single Python script driving roughly 350 concurrent containers. The corpus was split into 50 batches of about 150,000 repositories, with smaller batches chosen because they were safer at scale and easier to resume after interruptions. Each container bare-cloned a repository over SSH and ran TruffleHog and Kingfisher against the same on-disk copy.

Total wall time was about a month of continuous execution. Clone times dominated, since Gitee's servers sit in China and cross-Pacific SSH clones are materially slower than equivalent GitHub clones. The total cost came to $3,097.64, covered by a $5,000 compute-credit sponsorship from Modal. Zimmermann notes the same architecture works against most Git hosts with little more than a change of clone URL, and that he used a smaller version of the approach in an earlier investigation of Algolia DocSearch admin keys.

Complementary scanners, complementary blind spots

Running two tools mattered: either scanner alone would have surfaced only about half the credentials. Coverage was largely complementary. TruffleHog found 9,428 Alibaba Cloud keys to Kingfisher's 993, while Kingfisher dominated AI services, with 2,940 DeepSeek credentials to TruffleHog's 230, 1,198 OpenAI keys to 150, 154 HuggingFace tokens to 1, and 1,489 Zhipu credentials for which TruffleHog has no detector at all.

Alibaba Cloud AccessKey pairs were the single most common leak, appearing in roughly one in every 766 repositories scanned, followed by a long tail covering Stripe, Slack, MySQL, Algolia, OpenRouter, PostHog, OpenWeather and others.

The exposure is current rather than archival. The vast majority of verified credentials were committed within the last two years, and 2025 alone accounts for 12,242 of them, nearly half the dataset. Most were committed from personal email domains such as qq.com, 163.com and gmail.com, which makes company-level attribution impossible at scale, but the post reports smaller corporate footprints from Oracle, Apple, Meta and Anthropic alongside major Chinese technology companies and academic institutions.

Why it matters

Verified-live means exploitable now: these keys open cloud accounts, AI services and internal tooling for whoever finds them first, and this research shows that finding them cost about $3,100 and a month of compute. The prominence of AI credentials, from DeepSeek and OpenAI to Zhipu and HuggingFace, tracks how quickly model API keys have become the newest class of leaked secret. Because Gitee has no vendor-run scanning program equivalent to GitHub's, there is no automated backstop alerting maintainers when a key lands in a public repo; the closest comparable dataset, TruffleSecurity's scan of 5.6 million public GitLab repositories, shows how uneven protection remains across Git hosts. For anyone with keys in public Gitee history, the practical response is rotation first and history cleanup second.