Coding agents leave thousands of real secrets in public GitHub repositories
RESEARCHApiiroredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Apiiro research identified 2,539 live secrets across 1,994 public GitHub repositories, including a database vendor's admin-level cloud key, a production Azure Postgres password, a Square production token and the owner password of a medical-records database. The findings affect 63 organisations, and the article attributes the exposure to coding agents copying secrets into a hidden file. No CVE is involved. Defenders should treat any credential that may have reached a public repository as compromised, rotate it, and scan repositories for committed secrets.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Rotate any credentials that may have been committed to public GitHub repositories.
- Scan your repositories for hardcoded or copied secrets, including files created by coding agents.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
DataBreaches.net
Who and what is in it
Companies