Ben Zimmermann scanned 7,256,531 public Gitee repositories, including full commit history, with both TruffleHog and Kingfisher, keeping only credentials that the issuing service accepted. After de-duplication he counted 26,400 live secrets. The largest groups were Alibaba Cloud AccessKeys (9,473), YouTube/Google API keys (3,805), DeepSeek (3,170), Zhipu BigModel (1,489) and OpenAI (1,348), plus GitHub, AWS, Google Cloud and Gemini keys. One was an active organization-admin credential for an unnamed enterprise AI platform. He notified the vendors with the most exposed keys, not the individual developers, and had not confirmed revocations when he published.

Two findings worth acting on: about half the total came from 2025 commits, and the two scanners overlapped on only 1,001 credentials (TruffleHog 12,737, Kingfisher 14,664). TruffleHog has no Zhipu detector, so it found none of those keys.

What to do: if a key was ever pushed to a public repo on any host, revoke and rotate it at the provider; deleting the commit or rewriting history does not revoke it. Then check the provider's audit trail (for Alibaba Cloud, ActionTrail covers 90 days of API calls) and billing. If you rely on one secret scanner, test its detectors against the AI and cloud providers you actually use.