Over 543,000 Live Credentials Found Exposed Across Public GitHub Repositories

Truffle Security analyzed a snapshot of 224.5 million public GitHub repositories and verified 543,699 unique live credentials (1,103,438 exposures) in July 2026. The median leaked secret had been public for 784 days, with many remaining valid for years; Google Cloud service account keys, MongoDB connection strings, and Google API/Gemini keys were among the most common. GitHub push protection reduced new leaks for covered token types but did not address credentials already committed, and provider-side revocation effectiveness varied widely—database credentials often remained valid because they lack centralized revocation. The report urges immediate rotation of any committed credentials, repository-history scanning, and adoption of short-lived credentials.