Guide · Keys

Committed an AI API key to a public repo? What the 26,400-key Gitee scan means for you

On October 28, 2026, a scan of public repositories on Gitee reported 26,400 credentials that still authenticated. If one of them was yours, revoke it at the provider.

If a key was ever in a public repo, treat it as exposed. Revoke it at the provider, issue a new one, and redeploy. Deleting the file, or deleting the commit, does not revoke the key. The Hacker News notes that point from Truffle Security, the company that makes TruffleHog. [2]

Last checked . Figures below are only what Zimmermann's MongoDB post and The Hacker News state.

What the scan found

Independent researcher Ben Zimmermann scanned 7,256,531 public Gitee repositories. The Hacker News rounds that corpus to 7.25 million. After deduplicating by secret value, the scan reported 26,400 unique credentials that still authenticated against the vendor's API. TruffleHog ran with --only-verified and Kingfisher with --only-valid, so a string that merely looked like a key was dropped if it failed to authenticate. [1] [2]

The Hacker News, summarizing the same results, gives these group sizes: [2]

  • 9,473 Alibaba Cloud AccessKey pairs, the largest group.
  • 3,805 YouTube API keys.
  • 3,170 DeepSeek keys.
  • 1,489 keys for Zhipu's BigModel platform.
  • 1,348 OpenAI keys.

Zimmermann's post states the per-scanner counts, not a second unique total for each vendor. For Alibaba Cloud that is TruffleHog 9,428 and Kingfisher 993. Adding those would count overlap twice, so this page uses The Hacker News figure of 9,473 as the Alibaba total. For OpenAI the same post says Kingfisher found 1,198 and TruffleHog found 150. For DeepSeek, Kingfisher 2,940 and TruffleHog 230. For Zhipu, Kingfisher 1,489 and TruffleHog 0, because TruffleHog has no Zhipu detector. [1] [2]

OpenRouter is named in a long tail of other vendors, with no count. These two sources do not publish an Anthropic key count. [1]

By commit date, 12,242 of the 26,400 credentials were committed in 2025, nearly half. The Hacker News says some dated to the late 2000s. Zimmermann also describes one finding as an active organization-admin credential for a major enterprise AI platform. He does not name the platform. "Active" here means the credential authenticated at scan time. [1] [2]

Across every vendor, TruffleHog verified 12,737 credentials and Kingfisher verified 14,664. Only 1,001 were found by both. Either scanner alone would have caught about half. [1] [2]

What isn't known

The sources do not say that anyone used these keys. The Hacker News says Zimmermann did not say whether anyone else had used them. A credential that authenticates is not the same as a credential someone spent. [2]

Revocation was not confirmed at publication. Zimmermann wrote on October 28 that revocation status for the disclosed credentials had not yet been confirmed. He emailed the vendors with the highest exposure and did not contact each developer. The Hacker News, on October 29, reported the same: when he published, he had not confirmed that any of the reported credentials had been revoked. [1] [2]

The scan ran for about a month. Zimmermann did not publish the calendar dates, so these sources do not say how long before October 28 each credential was tested. [1] [2]

Check the old key's usage

Review usage on the key for the period it sat in a public commit. That window is the history of your repo, not the week the scan was published. Keep the export. If there is spend you do not recognize, ask the provider about a credit. Send the key name or the last characters, the time you revoked it, and the export. Do not send the secret. Neither of these sources says a credit will be granted.

The Hacker News quotes OpenAI: a compromised key lets someone else use the account's quota without consent, which can mean unexpected charges, a used-up monthly quota, and interrupted API access. [2] The provider steps for OpenAI, Anthropic, and OpenRouter are in the leaked-key guide.

Scan full history, not just HEAD

The scanners read each repository's full commit history. A key removed from the current files could still be found in an older commit and counted. The Hacker News says deleting a key from the code, or rewriting history, does not revoke it at the provider. [2]

Zimmermann bare-cloned each repo and ran TruffleHog and Kingfisher on that clone. Each scanner verified credentials the other missed, which is why the two totals above are not the same list. A scan of the latest commit only, or a single scanner, is a partial look. [1] [2]

Prevent the next one

Give each app its own key, so one leak maps to one service. Set a per-key daily cap where the provider allows one. The daily budget guide covers what OpenAI, Anthropic, and OpenRouter actually enforce.

Start free with one key, no card. BillCurfew emails you when a watched key passes a daily cap or spikes, checked about every five minutes, and a manual kill works on every plan, including Free. It does not detect that a key was committed, it does not detect malware, and it does not block the next request. Auto-kill is paid-only and stays off until you turn it on. It is not a proxy, so it does not sit in git.

What this product does not cover

BillCurfew watches OpenAI, Anthropic, and OpenRouter. It does not watch DeepSeek, Zhipu, or Alibaba Cloud keys. Those three are among the groups above. An OpenRouter key is in scope only if you connect OpenRouter. This page does not state how many OpenRouter keys the scan found, because the sources do not.

Sources

  1. Ben Zimmermann, Scanning 7.25 Million Public Repositories on China's Largest Git Platform for Secrets (MongoDB blog). https://www.mongodb.com/company/blog/technical/scanning-7-point-25-million-public-repositories-chinas-largest-git-platform-for-secrets
  2. The Hacker News, 26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories. https://thehackernews.com/2026/10/26400-valid-cloud-and-ai-credentials.html