Half a Million Active Keys Left on GitHub While Default Scanners Miss the Worst

A new analysis by Truffle Security reveals that public code repositories continue to host hundreds of thousands of active credentials. Researchers scanned 224 million repositories containing 58 billion files and uncovered 543,000 active tokens, keys, and passwords that remain valid and in use.

According to the findings, exposed data sat in the open for an average of 784 days, with the oldest functioning access keys dating back to 2009. Roughly 200,000 of these items ended up in repositories after GitHub enabled its default push-protection scanning mechanism. The built-in tool failed to catch them simply because the files used formats that the protection mechanism did not support.

The analysis shows that GitHub's native blocking mechanism can identify tokens for popular services like AWS, Slack, SendGrid, Stripe, and GCP. However, the tool intentionally skips database connection parameters to avoid false positives, alongside Google API keys and private keys.

The survival rate of exposed credentials varied wildly depending on the service. While only 0.001% of found NPM tokens and 0.35% of GitHub tokens remained active, database credentials fared much worse. Out of 12,985 PostgreSQL connection tokens, 88% were still active, along with 74% for MySQL, 54% for Google Cloud, 40% for SendGrid, and 33% for Docker Hub.

Source: habr