543,000 Valid Credentials Still Exposed on GitHub Despite Safeguards

Truffle Security’s analysis of 224 million GitHub repositories found over 543,000 valid credentials exposed, with some remaining accessible for up to 784 days. Despite GitHub’s Push Protection feature, nearly 37% of these credentials were leaked after its widespread implementation, highlighting gaps in blocking certain credential types. The study also revealed a rising trend in exposed credentials, with a peak of 11.62 per million files in 2025.