Listen to this Post
🎯 Introduction
The digital world is built on keys. API tokens, cloud credentials, passwords, automation secrets. They are silent guardians that keep our systems safe. But when those keys leak into public repositories, they become open doors for attackers. Recently, a security engineer scanned the entirety of GitLab’s public cloud and uncovered a stunning 17,000 exposed secrets scattered like landmines across the platform. What he found reveals a deep, ongoing security crisis in how developers manage their sensitive data.
Below is a full rewritten, humanized, expanded version of the report, crafted with an investigative tone and enriched with analysis.
The Hidden Danger Inside GitLab’s 5.6 Million Public Repositories
A Massive Sweep Across GitLab’s Public Landscape
A sweeping security audit across all 5.6 million public GitLab Cloud repositories has revealed one of the largest secret leaks ever documented. A security researcher named Luke Marshall used the TruffleHog open-source tool to scan every piece of code for sensitive information. The results were troubling. More than 17,000 verified, live, and still-active secrets were discovered across more than 2,800 domains. These included API keys, passwords, authentication tokens, and other credentials that should have never been published in the first place.
An Engineer with a Mission to Expose Hidden Risks
Marshall has made a name for himself by scanning major developer platforms to uncover how often organizations accidentally leak their internal keys. Before analyzing GitLab Cloud, he scanned Bitbucket and located more than 6,000 secrets hidden across 2.6 million repositories. He also examined data from Common Crawl, the massive dataset used for training AI models, and discovered an additional 12,000 secrets. His GitLab findings, however, dwarfed everything he encountered earlier.
How GitLab Became a Goldmine for Exposed Secrets
GitLab is home to millions of developers who use the platform for code hosting, CI and CD operations, DevOps pipelines, and team collaboration. With its convenience comes risk. One wrong commit or misconfigured automation workflow can expose sensitive credentials in seconds. Marshall used GitLab’s public API and a custom Python script to enumerate every repository, sort them by ID, and channel their names into an AWS SQS queue.
Automation at a Massive Scale
Once inside the queue, an AWS Lambda function took over. Each Lambda invocation ran TruffleHog against a repository and collected its findings. Marshall set concurrency to 1000, allowing his scanning infrastructure to tear through 5.6 million repositories in just over 24 hours. The entire operation cost only 770 dollars, a small price for insight into a massive security blind spot.
The Alarming Findings Hidden in Plain Sight
From this enormous dataset, 17,430 live secrets were verified. This is nearly triple the number found during the Bitbucket scan. Secret density was also significantly higher on GitLab, meaning more repositories contained leaks than on any platform examined before. While most leaked secrets were created after 2018, Marshall discovered active credentials dating back to 2009. Many remain functional today, posing long term risks to the organizations involved.
Who Leaked the Most Sensitive Keys
The scan revealed more than 5,200 Google Cloud Platform keys. MongoDB credentials, Telegram bot tokens, and OpenAI keys followed close behind. Even GitLab’s own keys made the list, with over 400 exposed in the public code. Many of these keys could grant full access to cloud environments, databases, internal communication tools, and private systems.
A Responsible Approach to a Dangerous Discovery
To handle disclosure ethically, Marshall used automated systems to notify affected organizations. Using Claude Sonnet 3.7, combined with Python scripts and web search integration, he generated thousands of responsible disclosure emails. His work did not go unnoticed. Multiple companies rewarded him with bug bounties totaling 9,000 dollars. Many organizations revoked their leaked secrets after receiving warnings. Yet a large number remain active and exposed in public code.
A Reminder That Security Debt Never Stops Growing
The incident underscores a troubling pattern in software development. Secrets continue to leak faster than companies can secure them. Even with modern automation tools, developers often commit sensitive data by accident. Outdated keys remain valid for years. And platforms like GitLab, hosting millions of repositories, give attackers an enormous hunting ground for exploitable credentials.
🧩 What Undercode Say: Expert Analysis and Deep Dive
A Global Snapshot of Developer Security Practices
The discovery of 17,000 live secrets paints a revealing picture of the current state of developer hygiene. It is not simply an accident or rare event. These numbers suggest that secret leakage is a systemic problem affecting organizations of all sizes. The fact that decades old credentials still function exposes a critical breakdown in key rotation and lifecycle management.
Why GitLab Shows Higher Secret Density
GitLab is widely favored for its CI and CD pipelines, which often integrate with third party platforms. These integrations typically rely on tokens and keys hardcoded into scripts. Without proper secret scanning, developers easily commit these sensitive values. The platform’s DevOps heavy ecosystem likely contributes to the high density of leaked credentials Marshall identified.
A 24 Hour Scan That Outperformed Entire Corporate Security Teams
One engineer, a few cloud services, and an open source tool uncovered what thousands of companies had missed for years. This exposes a harsh truth. Many organizations rely on perimeter security, firewall rules, and endpoint monitoring, yet fail to secure the most fundamental asset in their software supply chain: their code. A single leaked cloud key can compromise entire infrastructures, no matter how strong the perimeter is.
The Hidden Risk of Old Keys That Never Die
Credentials dating back to 2009 still functioning today is alarming. It means some organizations have never rotated their keys. These static keys can grant long term access to cloud resources, customer databases, or administrative environments. Attackers actively search platforms like GitHub, GitLab, Bitbucket, and public AI training data dumps for this exact type of credential.
Why Bug Bounties Are Not Enough
The fact that the researcher earned only 9,000 dollars for uncovering risks affecting 2,800 domains highlights a concerning issue. Many organizations rely on researchers to discover their leaks for them. Yet the incentives are low compared to the scale of the risk removed. Security engineering remains undervalued. And without increasing funding or automation, this cycle of accidental leaks will continue.
A Larger Systemic Problem Involving AI Datasets
Marshall’s discovery of exposed secrets in the Common Crawl dataset reveals another emerging threat. AI models trained on public code may inadvertently ingest credentials. If those secrets are ever reconstructed or generated as output, it could create new vulnerabilities. This is a frontier threat that cybersecurity teams are barely beginning to understand.
What Companies Must Do Right Now
Organizations should enforce automated secret scanning at commit time. Tools must block pushes containing sensitive credentials. Key rotation should happen quarterly or monthly, not yearly. Developers must stop embedding keys in repositories and move to centralized secret managers. Above all, security must become part of the development workflow instead of an afterthought.
A Warning That Will Not Be the Last
This GitLab scanning operation is not a one time event. Developers will continue leaking secrets. Attackers will keep scanning platforms for them. And unless organizations begin building preventive systems, incidents like this will become the norm. The findings represent not just a moment in time, but a stark warning about how fragile the global software ecosystem truly is.
🔍 Fact Checker Results
GitLab scan numbers match verified research data. ✅
Secret counts and cloud provider stats are consistent with the original report. ✅
Duration and cost of the scanning operation are accurately represented. ✅
📊 Prediction
The next two years will bring tighter automated secret scanning embedded into major developer platforms. 🔐
Attackers will increasingly use AI models to locate leaked keys faster than humans. 🤖
More massive credential leaks will surface as organizations begin auditing their public code at scale. ⚠️
🕵️📝✔️Let’s dive deep and fact‑check.
References:
Reported By: www.bleepingcomputer.com
Extra Source Hub (Possible Sources for article):
https://www.discord.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
Bing
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon
