Truffle Security finds 543,699 live credentials sitting in public GitHub repositories

Push Protection acts at one moment, the push, and only on formats in its default coverage ^[3][11]. GitHub made it the default on February 29, 2024 ^[9]. In Truffle Security's valid set ^[2], 343,856 credentials, or 63.2%, sit in files with timestamps before that date ^[1]. The default never applied to those pushes.

The density drop for covered formats holds up as an observational result. It compares periods before and after deployment, and the report says it is not the share of individual pushes blocked ^[11]. Uncovered formats barely moved over the same windows ^[10], so a general decline in leaking explains little of the drop. For the figure to describe a private organisation's repositories, its leaks would have to look like public default-branch code ^[4]. File last-modified times would also have to track when a key arrived ^[5]. A file edited after the key went in carries a later timestamp than the key itself. Deduplicating by value to the earliest copy limits that error across repositories ^[5]. The report still says its ages do not establish the first exposure date ^[8].

One bound does not depend on timestamps. Every credential in the set was in a crawl that ended on August 7, 2025 ^[4], and still authenticated on July 27-28, 2026 ^[6]. At least 354 days separate the last possible snapshot from a working login ^[2]. That gap does not prove the key worked every day in between ^[8].

The provider figures show where revocation happens. One of 101,886 npm token candidates authenticated, a rate that rounds to zero on any dashboard ^[12]. GitHub tokens came in at 260 of 73,048, about 0.36% ^[3]. Google Cloud service account credentials came in at 69,041 of 126,963, or 54.4% ^[4]. That is roughly 150 times the GitHub rate ^[5]. These pools include candidates that failed the check and are separate from the main analysis set ^[12]. A failed check can mean the issuer revoked the key or deleted it ^[13].

I think that spread is the most useful result in the report. It puts the remaining risk with key owners and issuers, at the step where a key gets rotated.

The methodology is careful in the places where a looser study would inflate its numbers. MongoDB is dropped because its detector reports a URI only after a successful connection ^[14]. Counting it would give MongoDB a 100% survival rate by construction ^[8]. Google API keys were tested only against Gemini, so the whole family is out of the survival calculations ^[15]. Private keys cannot be verified from the value alone and are excluded from survival rates as well ^[16].

For a team already running Push Protection, the open work is an inventory of keys already on default branches and a rotation path for each issuer. I would spend the next hour of security time there. The study did not measure whether any of the credentials had been misused ^[18].