Researchers Find 28,000 Exposed Git Repositories Leaking API Keys, Bank Details and Corporate Secrets

Security researchers used certificate transparency logs, targeted subdomains, Nuclei, and the gitreaper tool to scan 3.5 million internet-facing hosts and found ~28,000 publicly accessible .git repositories exposing secrets. The scan recovered hundreds of active credentials (400+ AWS keys, 107 Stripe keys, 123 OpenAI keys, 80 Telegram tokens, 17 GitHub tokens) and other sensitive files — a result of server misconfiguration and secrets remaining in repository history — creating significant risk for cloud compromise, payment fraud, and targeted phishing.