When people talk about leaked API keys they think of GitHub, but there's another huge code platform where almost nobody looks. An independent researcher scanned the entire public surface of Gitee, China's largest Git platform, and found 26,400 credentials that still worked when tested, many of them for AI services.
The Study: Method and Scope
Ben Zimmermann, an independent researcher, published the results on October 28 on MongoDB's engineering blog, in collaboration with the team behind his scanner Kingfisher. The Hacker News covered it on the 29th. He enumerated 7,256,531 unique public Gitee repositories, starting from 1,704,759 usernames, and cloned each one (with its full commit history) to run two scanners at once, TruffleHog and Kingfisher, which also test each candidate against the provider's API. Only credentials that were active at scan time are counted, deduplicated by value.
He ran about 350 containers in parallel for roughly a month, at a cost of $3,097.64, covered by a $5,000 credit from Modal. Useful to know when assessing risk: this is a cheap exercise, within reach of anyone with the same method, attackers included.
The Numbers
According to the study, roughly 1 in every 766 Gitee repositories held a valid Alibaba Cloud credential. The overall rate is 3.64 credentials per thousand repos, versus 3.11 on GitLab and 2.39 on Bitbucket, although those two figures come from earlier Truffle Security scans done with TruffleHog alone, so the comparison isn't exact. They also found an organization-admin credential for a major enterprise AI platform; neither the study nor THN names which one.
TruffleHog vs Kingfisher: The Real Technical Finding
Neither scanner saw everything on its own: TruffleHog reported 12,737, Kingfisher 14,664, and only 1,001 were detected by both. TruffleHog dominated Alibaba Cloud keys (9,428 versus Kingfisher's 993); Kingfisher dominated AI services: DeepSeek (2,940 versus 230), OpenAI (1,198 versus 150) and Zhipu (1,489 versus zero, since per THN TruffleHog has no detector for those keys). The reason is simple: each tool covers the providers its authors prioritized.