There’s no need for social engineering or break-ins: 1000s of billable Gemini and AWS access keys, database credentials, and other secrets can be quickly grabbed from public code and abused by attackers. Researchers sifted through 58 billion GitHub files and discovered 543,699 unique credentials that still authenticate to the corresponding services.

The Stack v3 is a massive, publicly available dataset of source code, crawled from GitHub for AI training. It consists of 224.6 million repositories and 58.47 billion files, divided into 4,096 chunks.

Researchers scanned it all for exposed secrets and found 543,699 unique credentials that still authenticate. Most of them have been exposed for years already – the code itself is over a year old, since the crawl completed on August 7th, 2025.

One of the live secrets was submitted over 16 years ago, while the median exposure was over 2 years.

“A leaked key that still authenticates is access,” warn Truffle Security researchers in a new report.

Over time, the situation has only worsened – the density of exposed secrets, measured per million files, has steadily increased since 2010. And the amount of submitted code has also grown year by year. Around 450 million GitHub files were last modified in 2014, and a decade later, in 2024, the figure was 23 times higher, or 10.4 billion.

“A leaked key that still authenticates is access,” warn Truffle Security researchers in a new report.

“A leaked key that still authenticates is access,” warn Truffle Security researchers in a new report.

Thousands of Gemini API keys are still live

Cybernews previously reported on developers going bankrupt over exposed Gemini API keys. Attackers abuse compromised keys to rack up massive AI charges, turning the Google Cloud’s subreddit into a wailing wall of developers staring at 5-figure bills.

It turns out that live Google API keys with Gemini access are the most numerous secret category in the public code.

Researchers counted 69,041 live Google Cloud service accounts with access to Gemini and excluded the remaining 3 million-plus non-sensitive Google API keys, which had access only to Maps, Firebase, and “everything else Google ships.”

“We never tested those, because a Maps key in public code is not a secret in the first place,” the report reads.

“A Gemini key is a billable credential attached to a model endpoint.”

The median leak date of live Gemini keys was February 2025.

The second most numerous exposed secret was the MongoDB database connection strings – 51,067 in total. They can give attackers access to data and, depending on permissions, the ability to read, copy, edit, or delete its contents.

The researchers also found 11,465 still-live Postgres connection strings, 9,189 SendGrid keys, 6,819 AWS access keys, 1,806 MySQL connection strings, 260 GitHub tokens, and thousands of other credentials that still authenticate.

GitHub has a blind spot

GitHub has implemented a default push protection feature that automatically scans code for hardcoded credentials and blocks pushes that contain them. Since February 2024, code pushed to public repositories gets checked, but developers can override the block if they choose to.

The researchers revealed a huge blind spot: 51.8% of exposed credentials are types that aren’t blocked by default.

GitHub can’t recognize connection strings, Google API keys, and private keys.

For example, sensitive Gemini keys and harmless Maps keys share an identical AIzaSy prefix, making it impossible for GitHub to tell them apart.

“Private keys and database connection strings count as generic patterns, which are not blocked by default and only become so if an organization opts in,” the researchers noted.

However, GitHub’s protection nearly eliminates the exposure of vendor-prefix tokens for GitHub, AWS, Slack, SendGrid, Stripe, and GCP service accounts. Push protection covers more than 200 token types from over 180 providers.