Thousands of Git Repositories Exposed in Widespread Credential Leak
Researchers at Intruder uncovered a critical security lapse exposing over 28,000 publicly accessible .git repositories, containing sensitive credentials, financial data, and internal records. The issue stems from misconfigured web servers inadvertently leaving Git directories reachable, allowing automated scanners to retrieve code, historical commits, and embedded secrets even after developers believed they had been removed.
The scan, conducted across 3.5 million live hosts, revealed 400+ active AWS access keys, 107 Stripe API keys, 123 OpenAI API keys, 80 Telegram tokens, and 17 GitHub personal access tokens. Some keys remained functional, granting potential access to cloud environments, payment systems, and internal documents. One exposed AWS key provided entry to a storage bucket holding employee records, including attendance logs and disciplinary files, while another leaked transaction histories, revenue data, and partial bank details via a payment service.
The risk is amplified by Git’s version history, which preserves secrets across deleted branches and past commits. Attackers increasingly automate credential harvesting, with prior research showing exposed AWS keys discovered within minutes of public disclosure. Intruder’s findings align with recent incidents, such as CISA’s GitHub exposure, where outdated cloud credentials remained exploitable for years.
The report highlights that exposed .git directories should be treated as urgent security incidents, not minor misconfigurations. Organizations are advised to revoke all credentials found in repository history, audit cloud and payment logs for misuse, and implement stricter access controls. Developers should adopt pre-commit secret scanning, block rules for sensitive files, and deployment checks to prevent recurrence.
Intruder responsibly notified affected parties, leading to repository takedowns and credential rotations in some cases. The incident underscores the broader risk: an exposed Git directory can serve as a searchable archive of organizational access, turning a development oversight into a critical breach vector.
Source: https://cybersecuritynews.com/28000-exposed-git-repositories/
GitHub TPRM report: https://www.rankiteo.com/company/github
Stripe TPRM report: https://www.rankiteo.com/company/stripe
OpenAI TPRM report: https://www.rankiteo.com/company/openai
Telegram TPRM report: https://www.rankiteo.com/company/telegram-messenger
"id": "telgitstrope1787733436",
"linkid": "telegram-messenger, github, stripe, openai",
"type": "Breach",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'type': 'Organizations with exposed .git '
'repositories'}],
'attack_vector': 'Misconfigured web servers exposing .git directories',
'data_breach': {'file_types_exposed': ['.git directories',
'Code',
'Historical commits'],
'number_of_records_exposed': '28,000+ repositories',
'personally_identifiable_information': 'Employee records '
'(attendance logs, '
'disciplinary files)',
'sensitivity_of_data': 'High (AWS keys, Stripe API keys, '
'OpenAI API keys, Telegram tokens, '
'GitHub tokens, PII)',
'type_of_data_compromised': ['Credentials',
'Financial data',
'Internal records',
'Employee records',
'Transaction histories',
'Revenue data',
'Partial bank details']},
'description': 'Researchers at Intruder uncovered a critical security lapse '
'exposing over 28,000 publicly accessible .git repositories, '
'containing sensitive credentials, financial data, and '
'internal records. The issue stems from misconfigured web '
'servers inadvertently leaving Git directories reachable, '
'allowing automated scanners to retrieve code, historical '
'commits, and embedded secrets even after developers believed '
'they had been removed.',
'impact': {'brand_reputation_impact': 'Potential damage due to exposure of '
'sensitive data',
'data_compromised': 'Credentials, financial data, internal '
'records, employee records, transaction '
'histories, revenue data, partial bank details',
'identity_theft_risk': 'High (employee records, PII)',
'operational_impact': 'Potential unauthorized access to cloud '
'environments, payment systems, and internal '
'documents',
'payment_information_risk': 'High (Stripe API keys, transaction '
'histories, partial bank details)',
'systems_affected': 'Publicly accessible .git repositories, cloud '
'environments, payment systems'},
'lessons_learned': 'Exposed .git directories should be treated as urgent '
'security incidents. Version history in Git preserves '
'secrets across deleted branches and past commits, making '
'credential harvesting a significant risk.',
'post_incident_analysis': {'corrective_actions': 'Repository takedowns, '
'credential rotations, '
'implementation of '
'pre-commit secret scanning, '
'and stricter access '
'controls',
'root_causes': 'Misconfigured web servers leaving '
'.git directories publicly '
'accessible'},
'recommendations': ['Revoke all credentials found in repository history',
'Audit cloud and payment logs for misuse',
'Implement stricter access controls',
'Adopt pre-commit secret scanning',
'Use block rules for sensitive files',
'Enforce deployment checks to prevent recurrence'],
'references': [{'source': 'Intruder Research'},
{'source': 'CISA GitHub exposure incident'}],
'response': {'communication_strategy': 'Responsible disclosure to affected '
'parties',
'containment_measures': 'Repository takedowns, credential '
'rotations',
'remediation_measures': 'Revocation of exposed credentials, '
'auditing cloud and payment logs for '
'misuse',
'third_party_assistance': 'Intruder (researchers)'},
'title': 'Thousands of Git Repositories Exposed in Widespread Credential Leak',
'type': 'Data Exposure',
'vulnerability_exploited': 'Exposed .git directories with sensitive data in '
'version history'}