26,400 live credentials found scanning 7.25M repos on China's Gitee
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
A researcher scanned 7,256,531 public Gitee repositories with TruffleHog and Kingfisher and found 26,400 unique credentials that authenticated against vendor APIs, with Alibaba Cloud keys the most common. The run took about a month and cost $3,097.64, covered by Modal credits. That works out to 3.64 per 1,000 repositories, versus 3.11 for GitLab and 2.39 for Bitbucket, but those earlier scans used TruffleHog alone; TruffleHog-only, Gitee falls to 1.76. Each scanner alone found about half, so detector coverage matters. Revocation of disclosed keys is unconfirmed.