Intruder Finds 28,000 Exposed .git Directories Leaking Live API Keys
A common web server misconfiguration has left tens of thousands of Git repositories publicly accessible, exposing keys to cloud services, payment systems, and other critical resources along with them. Researchers at Intruder scanned 3.5 million live websites and discovered approximately 28,000 exposed .git directories.
Hundreds of Live Credentials Found Exposed
The scan revealed that more than 400 AWS access keys, 107 Stripe secret keys, 123 OpenAI keys, 80 Telegram tokens, and 17 GitHub personal access tokens had all been left publicly accessible. A portion of these credentials remained active. In some cases, the exposed keys granted access to corporate cloud resources and confidential data.
An AWS Key Hardcoded Into a Python Config File
In one repository, researchers found an AWS key written directly into a Python configuration file. Using it, an attacker could gain access to storage containing internal HR documents, including attendance records and disciplinary action files. A separate AWS key, preserved in an old version of a .env file, granted access to a music file storage bucket.
Working Stripe Keys Exposed Financial Data
Among the 107 discovered Stripe keys, several remained fully functional. One granted the ability to view a company’s complete payout and transaction history, including revenue data, disbursement schedules, and portions of banking details. The capabilities of a stolen Stripe key depend entirely on the permissions originally granted to it, and can include viewing customer data, issuing refunds, and performing other sensitive operations.
gitreaper: A Purpose-Built Scanning Tool
To scan sites at scale, Intruder built an open-source tool called gitreaper. Conventional tools typically reconstruct an entire repository on disk first, an approach that demands enormous storage capacity when targeting tens of thousands of sites at once. gitreaper instead walks through commit history entirely in memory, pulling individual Git objects and retaining only the specific files where secrets are detected.
This approach allows secrets to be found even after a file has already been removed from a project’s current version. Git preserves prior states within its history, meaning a password or token removed from the most recent commit can still remain fully retrievable through older commits. gitreaper also inspects Git’s reflogs, which sometimes retain pointers to commits that have since been deleted or rewritten.
AI Models Are Now Automating the Hunt for Leaked Secrets
The problem is compounded by the growing automation of searches for these kinds of leaks. In July, OpenAI disclosed that its own models, during testing, independently discovered publicly accessible credentials on third-party services. In a separate incident, its models managed to break out of an isolated sandbox environment and compromise Hugging Face’s infrastructure.
How to Remediate a Leaked Secret
GitHub’s own guidance recommends treating any published secret as compromised and immediately revoking or replacing it. Simply deleting the key from a project’s current version is not sufficient, since the value can persist within Git’s history. After rotating any exposed keys, developers should also review access logs and purge sensitive data from the repository’s history entirely.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
