A large-scale credential-exposure investigation scanned 7,256,531 public repositories on Gitee, China’s largest domestic Git-hosting platform. Because Gitee’s official API offers limited access and its code search is constrained, the researcher pieced together a repository list from user searches, Explore feeds, users’ project and starred-repository pages, and the internal search service powering Gitee’s website. The process built a corpus of 1,704,759 usernames and used recursive, subdivided searches to find repositories beyond that social network. The work highlights how secrets can remain exposed in Git history and how limited platform-wide scanning leaves risks difficult to identify.
Repositories were bare-cloned using a serverless compute setup, then scanned concurrently with TruffleHog and MongoDB’s Kingfisher. Both tools checked candidate secrets against vendor services, so only credentials that authenticated at scan time were counted; duplicates were removed by secret value. The combined scan found 26,400 unique live credentials: TruffleHog found 12,737, Kingfisher 14,664, and 1,001 were detected by both. Findings included thousands of active cloud-provider access keys and an organization-admin credential for a major enterprise AI platform. Running the scan across 350 concurrent workers took about a month and cost $3,097.64, covered by compute-credit sponsorship. The researcher argues that the same dual-scanner approach can be adapted to other Git-hosting services.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Attackers attempted to exploit critical GitLab vulnerability CVE-2026-97229 on Alpine Linux’s instance, crashing worker processes, but Alpine found no evidence of successful access or tampering. Alpine rebuilt the instance, reset passwords, and warns that self-managed GitLab deployments also need patched Ruby - not just a GitLab upgrade. (alpinelinux.org)
An iPhone backup audit reportedly uncovered more than 145,000 deleted photos and videos in a thumbnail cache, including sensitive images. The claim that apps with file access could read them has not been independently verified. (twitter.com)
A leak of DHS records exposed personal and workplace details for more than 41,000 employees and contractors, including undercover ICE agents and information about surveillance programs. Distributed Denial of Secrets published the data, while Okta said it had no evidence its systems were breached. (wired.com)
Several PDF tools generate advertised AES-256 keys from weak randomness, making encrypted files vulnerable to passwordless decryption. MuPDF versions before 1.28.5 expose only 9 bits of random state in the key, while Foxit relies on predictable time-based randomness. (v12.sh)
Distributed Denial of Secrets published a searchable database with contact information for nearly 40,000 DHS employees, reportedly obtained through an Okta single sign-on leak. The group says the database highlights officials overseeing agency policies and operations, including immigration enforcement and covert programs. (techdirt.com)
Distributed Denial of Secrets released personal and job data on more than 40,000 DHS employees, including staff in surveillance, intelligence, and undercover roles. The group says the data came from a hack of DHS’s Okta sign-on service, but Reuters could not verify the full trove and Okta reported no evidence of a compromise. (reuters.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.