What Happened
Truffle Security analyzed a dataset built for training large language models and found 543,699 unique valid credentials across 224 million repositories. The scan covered 58 billion files from a crawl closing August 7, 2025, and the analysis ran in July 2026. The median credential stayed exposed for 784 days. About 10 percent were older than 6.3 years, and the oldest dated to 2009.
Google Cloud service account credentials led the valid set at 69,041 of 126,963 found. Only one of 101,886 npm tokens remained valid. Push protection did not close the gap. GitHub turned it on by default in February 2024, yet 199,843 credentials, or 36.8 percent, appeared afterward. About 51.8 percent of live credentials fell outside the categories default protection covers. Read the details at BleepingComputer.
Why This Matters for Canadian Organizations
Canadian startups, agencies, and public sector developers host code on GitHub every day. A leaked cloud key or database connection string gives an attacker the same access your application has. If the account holds personal information, PIPEDA requires safeguards proportionate to its sensitivity and breach reporting when a real risk of significant harm exists. Quebec’s Law 25 adds its own incident duties.
The trend is worth your attention. Old secrets do not expire on their own. A key committed years ago by a departed contractor still opens doors today.
What to Do
Rotate exposed credentials rather than deleting the commit. Deletion leaves the secret in history and forks. Scan full repository history, including personal accounts of contributors. Add custom secret patterns to push protection, since defaults miss half of live credential types. Set automatic expiry on tokens and prefer short-lived identity over long-lived service account keys. Inventory every Google Cloud service account key in your organization this week.
