More than 543,000 valid credentials were found exposed in public GitHub repositories as of July 2026, despite the platform's security measures designed to prevent such leaks. Research conducted by Truffle Security, based on a dataset assembled for training large language models from a crawl that concluded on August 7, 2025, revealed that the median duration a unique credential remained publicly accessible was 784 days.
The researchers identified 543,699 unique, working credentials appearing across over 1.1 million files and repositories, including copies in forks. Approximately 10% of these active credentials were over 6.3 years old, with the oldest dating back to 2009. This figure more than doubles the 221,303 working credentials Truffle Security found exposed on Hugging Face in August of the same year. The study also noted an increase in secret density over time, with working credentials rising from 3.72 per million files in 2015 to a peak of 11.62 in 2025.
GitHub introduced its Push Protection feature, which scans incoming code for secret patterns like API keys and access tokens and blocks uploads if detected, in April 2022 for Advanced Security users. It became available for public repositories in May 2023 and was enabled by default in February 2024. However, Push Protection does not revoke credentials that were exposed prior to its implementation.
Truffle Security's analysis indicated that 199,843 of the credentials identified in July were exposed after Push Protection was enabled for all users in February 2024, accounting for roughly 36.8% of the total. A significant portion, 51.8%, of the live credentials fell into categories not covered by GitHub's default Push Protection, such as database connection strings and Google API keys. Within its scope, however, Push Protection appears effective, as the rate of exposed credentials in protected categories decreased by 53% after the feature was enabled by default.
The likelihood of revocation varies significantly by credential type. For instance, out of 101,886 committed npm tokens, only one was found to still be active. In contrast, among 126,963 exposed Google Cloud service account credentials, 69,041 remained valid and functional at the time of the analysis.
The findings highlight the ongoing challenge of secret exposure in public repositories. While the research quantifies the scale of working secrets on GitHub, it does not determine the percentage of these secrets that have been compromised or exploited by malicious actors. Organizations are advised to promptly rotate any exposed credentials, clean up repositories, scan repository history for past leaks, and implement automatic expiration for all active secrets.
