Scan of 5.6 million GitLab repositories reveals over 17,000 exposed secrets

A large-scale audit of GitLab Cloud public repositories uncovered more than 17,000 active secrets across nearly 2,800 domains, raising fresh concerns over developer security practices and the widespread leakage of sensitive credentials on open platforms.

A sweeping security assessment of GitLab Cloud has revealed more than 17,000 live secrets unintentionally exposed in public code. Security engineer Luke Marshall conducted the scan using TruffleHog, an open-source tool designed to detect sensitive credentials such as API keys, tokens, and passwords. The review covered all 5.6 million public repositories on the platform, highlighting significant risks stemming from insecure coding and repository hygiene.

Automation enables 24-hour scan of millions of repositories

To execute the large-scale audit, Marshall leveraged GitLab’s public API to enumerate every public repository and channelled the data through Amazon Web Services for automated analysis. Repository names were queued through AWS Simple Queue Service, while AWS Lambda instances ran TruffleHog scans with high concurrency. This setup enabled the entire scan to finish in just over 24 hours at a cost of $770.

The findings reveal 17,430 verified secrets—nearly triple the number discovered in a previous Bitbucket audit—with a 35% higher density of exposed credentials. Some secrets dated back to 2009 and remained active, despite industry-wide efforts to improve secret management.

GCP keys lead exposed credentials; notifications trigger revocations

Google Cloud Platform keys accounted for the largest share of leaked secrets, followed by MongoDB credentials, Telegram bot tokens, OpenAI keys, and more than 400 GitLab API keys.

To alert affected organizations, Marshall deployed automated notification workflows using AI-assisted email generation. His disclosures led to multiple bug bounty rewards totalling $9,000. While many companies responded by revoking compromised keys, a number of exposed secrets still remain publicly accessible on GitLab.