Researcher scans 7.25M Gitee repos, reports 26,400 live credentials
A security researcher, in collaboration with MongoDB's Kingfisher team, enumerated about 7.25 million public repositories on Gitee, China's largest indigenous Git hosting platform, and scanned them with TruffleHog and Kingfisher. The work reports 26,400 unique verified-live credentials, including an active organization-admin credential for a major enterprise AI platform and thousands of live cloud provider access keys. Repository enumeration relied on Gitee's limited official API, per-user web pages, and an internal Elasticsearch search widget, with bucket splitting to escape a 200-result cap. Scanning ran on serverless infrastructure over roughly one month.
Open original source www.mongodb.comOne primary source; other links are context, not independent corroboration.
- Primary sourceHacker News discovery · automated brief
- Discovery linkHacker News
Grok Bot submitted the link. AINewsIQ fetched the primary source and prepared a source-based brief automatically. An editor has not reviewed the story; social attention and the brief do not independently verify its claims.
Open full article view →- Linked article+30
- Fetched source page+30
- No editor link review+0
- Original non-discussion link+5
This measures the stored source trail and editorial steps. It does not certify accuracy, peer review, or independent corroboration. Popularity adds no points.
View full scoring →Read the scoring rubric →What the source says
A security researcher, in collaboration with MongoDB's Kingfisher team, enumerated about 7.25 million public repositories on Gitee, China's largest indigenous Git hosting platform, and scanned them with TruffleHog and Kingfisher. The work reports 26,400 unique verified-live credentials, including an active organization-admin credential for a major enterprise AI platform and thousands of live cloud provider access keys. Repository enumeration relied on Gitee's limited official API, per-user web pages, and an internal Elasticsearch search widget, with bucket splitting to escape a 200-result cap. Scanning ran on serverless infrastructure over roughly one month.
A READER'S EVIDENCE CHECKHow to read this signalSix questions about claims, sources, risks, and open checks
This is a signal-level guide until claim-level evidence is available. “Not recorded” means the evidence has not been assessed here; it does not mean a result is false. How we check AI news →
- 01Who is making each claim?
The claimant and whether each claim was measured or asserted are not recorded in this public brief.
- 02What was actually tested?
Not recorded per claim. Check the source for sample size, tasks, model and benchmark versions, and reproducibility.
- 03Where are the sources?
Original link: www.mongodb.com. Brief basis: fetched source page. Primary page date and quote locations are not established in this panel.
- 04What could mislead?
Source claims not independently checked; the post is a guest post developed with MongoDB's Kingfisher team, and the disclosure details of affected parties are not described in the supplied text.
- 05What is at risk if wrong?
Not assessed per claim. Consider safety, privacy, cost, and adoption decisions before relying on the result.
- 06What would change the view?
No claim-specific check is recorded. An inspectable primary method or independent replication could change the assessment.
Key findings from the stored brief
- The researcher reports scanning 7,256,531 public Gitee repositories with both TruffleHog and Kingfisher.
- Verified-live findings reportedly total 26,400 unique credentials, including an organization-admin key for an enterprise AI platform.
- Running both scanners concurrently reportedly caught credentials that either scanner alone missed.
- Gitee's API was severely constrained, so enumeration combined the REST search endpoint, Explore feed, per-user pages, and an internal search widget.
Source claims not independently checked; the post is a guest post developed with MongoDB's Kingfisher team, and the disclosure details of affected parties are not described in the supplied text.
This is a source-based abstract, not independent validation of the source's claims.
Evidence & sources
These links show where the signal came from and what the source page linked to. A linked page is context, not independent corroboration.
Grok Bot submitted the link. AINewsIQ fetched the primary source and prepared a source-based brief automatically. An editor has not reviewed the story; social attention and the brief do not independently verify its claims.
These are Grok Bot discovery notes. AINewsIQ prepared a brief from available source material. The bot's rationale, linked posts, authors, and stances have not been independently verified.
In a MongoDB-hosted guest post, independent researcher Ben Zimmermann reports scanning 7,256,531 public repos on China's Gitee with TruffleHog and MongoDB's Kingfisher, finding 26,400 unique verified-live credentials. Findings included an active org-admin credential for a major enterprise AI platform and thousands of live cloud keys. Single-researcher findings; platform not named.
Source claims not independently checked; the post is a guest post developed with MongoDB's Kingfisher team, and the disclosure details of affected parties are not described in the supplied text.
Engagement counts, when shown, are observed snapshots. They do not establish accuracy or corroboration.
- hn post ↗ · 13 points, 2 comments · observed 10/28/2026, 4:14:05 PM
Timeline & updates
- Signal dated by source or discovery feed
This timestamp places the signal in the radar. It may be the discovery post date rather than the primary page's first publication date.
- Shared brief stored
AINewsIQ prepared one abstract from fetched source page.
A publication revision history is not stored for this signal. New engagement snapshots do not mean the source itself changed.
Why this may matter
The findings suggest that live secrets persist in public repositories on platforms lacking vendor secret-scanning partnerships, and that exposed admin keys for AI platforms could carry significant access risk.
Limits and open questions
Source claims not independently checked; the post is a guest post developed with MongoDB's Kingfisher team, and the disclosure details of affected parties are not described in the supplied text.
Organization-specific financial, security, and operational effects require the organization's own context and review.
Discussion
Comments are reviewed before publication. Discuss the evidence, not the person.
No published comments yet.
Reader discussion opens with accounts. You can read the original source and published comments now.