Coding agents leave thousands of real secrets in public GitHub repositories
RESEARCHApiiroredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Apiiro research found 2,539 real secrets in 1,994 public GitHub repositories, including database passwords, cloud keys, API tokens and SSH root logins. Examples include a database vendor's admin-level cloud key, a production Azure Postgres password, a Square production token and the owner password of a medical-records database. The article says coding agents copy secrets into a hidden file, and it reports that 63 organisations were affected, though the text is cut off.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Rotate any credentials that may have been committed to public GitHub repositories.
- Scan your repositories for hardcoded or copied secrets, including files created by coding agents.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
DataBreaches.net
Who and what is in it
Companies