Security researchers have discovered 28,000 publicly accessible Git repositories exposing API keys, bank-related information, corporate data, and other sensitive secrets.
The findings came from a scan of 3.5 million internet-facing hosts using gitreaper, an open-source tool developed by Intruder.
The research highlights how a simple server misconfiguration can expose credentials that provide attackers with access to cloud services, payment platforms, private code, and internal documents.
Researchers first identified 40 million potentially interesting domains from Certificate Transparency logs. They focused on subdomains commonly used for applications, development, and administration, including app, admin, and dev.
Using distributed scanning infrastructure, the team reduced the list to 3.5 million hosts running active HTTP services. They then used Nuclei to identify exposed .git repositories.
Unlike normal Git tools, gitreaper does not need to download an entire repository to disk. This matters because repositories can range from a few megabytes to tens of gigabytes. Downloading thousands of repositories could require terabytes of storage.
Instead, the tool processes Git objects in memory, scans them for secrets, and saves only files containing potential credentials. This allows researchers to inspect a large number of exposed repositories more efficiently.
Git Repositories Leak Secrets
Git repositories store code and history as objects identified by SHA-1 hashes. These include commits, trees, and blobs. Commits point to repository snapshots, trees map directories and filenames, and blobs contain the actual file content.
gitreaper starts by trying common Git files and paths, including HEAD, packed-refs, common branch names such as main, master, and develop, and reflogs.
Reflogs can reveal commit hashes from deleted or rewritten branches that are no longer visible in the current repository state.
After finding a starting commit, the tool walks through the full commit history. It fetches commits, identifies parent commits, and retrieves associated trees and blobs. It also avoids downloading identical objects more than once by tracking their hashes.
This approach is important because developers often remove secrets from the latest version of a project but forget that the credentials remain available in earlier commits.
An attacker who accesses an exposed .git directory may still retrieve those deleted files through the repository history.
The tool scans recovered file content against secret-detection rules. It uses filtering methods such as entropy checks, placeholder detection, template detection, and runtime-value detection to reduce false positives.
The scan uncovered more than 400 AWS access keys, 107 Stripe API keys, 123 OpenAI API keys, 80 Telegram tokens, and 17 GitHub personal access tokens. Researchers said many credentials were still active during testing, intruder said.
Some AWS keys exposed access to internal storage buckets. In one case, a Python settings file contained credentials connected to employment-related documents, including attendance records and disciplinary information. Such data could support targeted phishing and social-engineering attacks.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
