Thousands of Git Repositories Exposed Sensitive Data, Including API Keys and Bank Details
Researchers discovered 28,000 publicly accessible .git repositories containing sensitive data like API keys, bank details, and employee records, posing significant risks to organizations.
A significant security oversight has led to the exposure of approximately 28,000 publicly accessible .git repositories, revealing a trove of sensitive data including API keys, financial information, and internal employee records. This discovery presents a direct pathway for malicious actors to infiltrate cloud accounts and compromise business systems.
The vulnerability stems from a common development error: inadvertently leaving hidden Git directories reachable via the web. Automated scanners can then exploit this exposure to retrieve not only the current codebase but also historical versions of files. This means that even if secrets like passwords or API keys are removed from the latest code, they can persist in past commits, remaining accessible to anyone who finds the exposed repository.
Researchers from Intruder identified this widespread issue while conducting a large-scale examination of internet-facing systems. Their analysis of 3.5 million hosts revealed that this problem can persist long after developers believe sensitive information has been purged. This echoes previous findings regarding old cloud keys remaining active years after their initial exposure, highlighting the persistent danger of historical data.
The tool developed by Intruder, named gitreaper, was instrumental in this discovery. It inspects repository history in memory without needing to download entire projects, efficiently identifying secrets committed in past versions. The research team found over 400 AWS access keys, 107 Stripe API keys, 123 OpenAI API keys, 80 Telegram tokens, and 17 GitHub personal access tokens. Crucially, some of these credentials were still active at the time of testing, potentially granting attackers immediate access to associated systems.
One particularly concerning finding involved an AWS key that provided access to a bucket containing internal employment documents, including disciplinary records. Such information can be weaponized by attackers to craft highly convincing phishing messages, target specific employees, or even extort organizations by threatening to release sensitive HR data. Another exposed key, found in a configuration file, granted access to a payment service, revealing payout schedules, transaction histories, and partial bank account details.
This incident underscores the critical importance of treating exposed Git directories as urgent security incidents. Attackers are increasingly automating the search for such exposed secrets, with some bots capable of locating exposed credentials within minutes of their disclosure. Organizations must act swiftly to remove public access to .git directories, identify any compromised repositories, and rotate all credentials found in both current and historical commits.
Beyond immediate remediation, a robust security posture requires proactive measures. This includes reviewing cloud and payment logs for suspicious activity, implementing least privilege access controls for all credentials, and migrating secrets to secure, managed vault systems. Regular scanning for exposed environment configuration files can also help prevent similar breaches. Furthermore, developers need stricter controls, such as secret scanning in commits and blocking rules for private files, to prevent secrets from ever reaching production environments.
While Intruder responsibly notified affected parties and saw several repositories secured and credentials rotated, the broader lesson remains clear: hidden development folders are not harmless when exposed online. They can transform into searchable archives, providing attackers with persistent access to an organization's critical systems and data.