Reported by 2 outlets
28,000 Exposed .git Repositories Leak Active AWS, OpenAI, Stripe and GitHub Credentials
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.55 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
28,000 Exposed .git Repositories Leak Active AWS, OpenAI, Stripe and GitHub Credentials
gbhackers.com · 48d ago · August 26th, 2026
A large-scale internet scan has uncovered 28,000 publicly accessible .git repositories exposing credentials for AWS, OpenAI, Stripe, GitHub, and other services, illustrating how a basic web server misconfiguration can turn source code history into an immediate cloud access risk. The research, published by attack-surface management firm Intruder, examined 3.5 million live HTTP hosts selected from […] The post 28,000 Exposed .git Repositories Leak Active AWS, OpenAI, Stripe and GitHub Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Researchers Find 28,000 Exposed Git Repositories Leaking API Keys, Bank Details and Corporate Secrets
cyberpress.org · 48d ago · August 26th, 2026
Security researchers have discovered 28,000 publicly accessible Git repositories exposing API keys, bank-related information, corporate data, and other sensitive secrets. The findings came from a scan of 3.5 million internet-facing hosts using gitreaper, an open-source tool developed by Intruder. The research highlights how a simple server misconfiguration can expose credentials that provide attackers with access to cloud services, payment platforms, private code, and internal documents. Researchers first identified 40 million potentially interesting domains from Certificate Transparency logs. They focused on subdomains commonly used for applications, development, and administration, including app , admin , and dev . Using distributed scanning infrastructure, the team reduced the list to 3.5 million hosts running active HTTP services . They then used Nuclei to identify exposed .git repositories. Unlike normal Git tools, gitreaper does not need to download an entire repository to disk. This matters because repositories can range from a few megabytes to tens of gigabytes. Downloading thousands of repositories could require terabytes of storage. Instead, the tool processes Git objects in memory, scans them for secrets, and saves only files containing potential credentials. This allows researchers to inspect a large number of exposed repositories more efficiently. These in