PUBLIC GITLAB REPOSITORIES EXPOSED MORE THAN 17,000 SECRETS

Summary from the TLDR InfoSec newsletter

Security researcher Luke Marshall examined all 5.6 million public GitLab Cloud repositories with TruffleHog and found 17,430 verified active secrets across 2,804 distinct domains. This exposure is nearly three times that found in a similar scan of Bitbucket. The leaked credentials included over 5,200 Google Cloud Platform keys, MongoDB credentials, Telegram bot tokens, and OpenAI keys. Some secrets date back to 2009 and are still valid today. Although many organizations revoked their credentials after receiving automated alerts—earning the researcher $9,000 in bug bounties—some secrets continue to be exposed on GitLab repositories.