Act
archived
543,000 valid credentials still exposed in public GitHub repos
- Engineer — Act: Exposed valid credentials are an immediate risk whether or not your org is named — scan all org-owned public (and private) GitHub repos for secrets now using truffleHog or GitHub secret scanning, rotate any discovered credentials, and enable GitHub push protection to block future leaks.
- SOC/IR — Plan: No specific IOCs are published, but the scale of valid exposed credentials raises likelihood of credential-stuffing and unauthorized API use; build or tune detections for anomalous service-account logins and impossible-travel alerts tied to CI/CD or cloud API keys.
- Leader — Plan: Direct engineering to run a full secrets audit across org repositories this quarter, verify GitHub push-protection and secret-scanning policies are enforced, and add credential-leakage exposure to the risk register as a developer-practice control gap.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.