543,699 live credentials found in 224M GitHub repos — median exposed 784 days
jedisct1 · x · 2026-10-08
Truffle Security scanned The Stack v3, a 224M-repo public GitHub corpus built for LLM training (58.5B files), and found 543,699 unique credentials still authenticating in July 2026. The median had sat in a public default branch for 784 days; the oldest dates to 2009 and still works. GitHub's default-on push protection roughly halves the rate for recognized credential shapes, but 51.8% of live secrets are shapes it doesn't catch, and nothing helps the half million already exposed — and nobody revoked them.
More from Infra
- Reddit asks: have AI scaling laws hit their limit, or is the compute buildout just starting? — StupidDialUp · 2026-10-08
- TRIAGE stabilizes native NVFP4 RL training, hits full-precision quality at 2.3x throughput — InfiX-ai · 2026-10-08
- WSL Containers Now Generally Available: Run Linux Containers Natively on Windows — pavandavuluri · 2026-10-08
- ai& Says It's Japan's Largest Dedicated Inference Provider, Teases Post-Training Offerings — DavidBennett__ · 2026-10-08
- Microsoft unveils Surface Laptop Ultra with Nvidia RTX Spark SoC from $2,599 — Ars Technica AI · 2026-10-08
- DeepSeek V4.1 shrinks cache 437x, Flash beats V4-Pro 39 vs 36 at half the cost — DeepLearningAI · 2026-10-08