26,400 valid cloud and AI credentials found exposed in public Gitee repositories

According to The Hacker News, 26,400 valid cloud and AI service credentials have been found exposed in public repositories on the code hosting platform Gitee. The available headline and summary do not say who ran the scan, which cloud and AI providers were affected, or how long the credentials had been exposed, so those details remain to be reported.

Credentials here means strings that convert directly into access: API keys, access tokens, database passwords. Once they are hardcoded into code and pushed to a public repository, the key is effectively hanging on the door — anyone who clones the repo can read it, no exploit required.

The pattern behind these incidents is remarkably consistent: secrets written into config files during prototyping, sample scripts that were never scrubbed, CI configs or notebooks committed without a second look. Deleting the commit afterwards rarely helps, because history persists and scanners crawl in minutes, not days.

AI credentials are especially exposed. Model calls are metered, so a leaked key can be used to generate an enormous bill in a short window; a cloud credential can mean access to object storage, compute instances or internal networks, so the risk is not only financial.

For teams running public projects on Gitee, the mitigations are familiar: turn on the platform's secret scanning, rotate every key that has ever appeared in history, give each key the minimum scope and a spend cap, and add a pre-commit hook before pushing.

The scale is the real signal. More than twenty thousand valid credentials point to a systemic default rather than isolated mistakes — which is precisely why major code hosting platforms have spent recent years making secret scanning on by default. What to watch next is whether the reporting names the affected providers and whether the exposed credentials have since been revoked.