543,000 valid credentials still exposed in public GitHub repos

Thu, 01 Oct 2026 17:21:52 +0000

Engineer — Act: Exposed valid credentials are an immediate risk whether or not your org is named — scan all org-owned public (and private) GitHub repos for secrets now using truffleHog or GitHub secret scanning, rotate any discovered credentials, and enable GitHub push protection to block future leaks.
SOC/IR — Plan: No specific IOCs are published, but the scale of valid exposed credentials raises likelihood of credential-stuffing and unauthorized API use; build or tune detections for anomalous service-account logins and impossible-travel alerts tied to CI/CD or cloud API keys.
Leader — Plan: Direct engineering to run a full secrets audit across org repositories this quarter, verify GitHub push-protection and secret-scanning policies are enforced, and add credential-leakage exposure to the risk register as a developer-practice control gap.

Github-Secrets on CuraSec