独立安全研究员Ben Zimmermann与MongoDB的Kingfisher团队合作，报告称使用TruffleHog和Kingfisher扫描了中国Gitee上的7,256,531个公开代码仓库。
Scan of 7.25 Million Gitee Repositories Finds 26,400 Verified-Live Credentials Independent security researcher Ben Zimmermann, working with MongoDB’s Kingfisher team, reports scanning 7,256,531 public repositories on China’s Gitee using TruffleHog and Kingfisher.
扫描发现26,400个经认证仍处于活跃状态的唯一凭证，其中包括云服务和AI服务凭证。
The scan found 26,400 unique credentials that authenticated as live, including cloud and AI-service credentials.
该研究耗时约一个月，成本为3,097.64美元，由5,000美元的Modal算力信用额度赞助覆盖。
The research took roughly one month and cost $3,097.64, covered by a $5,000 Modal compute-credit sponsorship.
文章称研究员已向暴露量大的供应商发送邮件，并提供了凭证和仓库详情，但在发稿时尚未确认撤销情况。
The article says the researcher emailed vendors with high exposure volumes and supplied credential and repository details, but revocation had not been confirmed at publication.
文章还报告称，许多凭证是在过去两年内提交的，其中12,242个归属于2025年。
It also reports that many credentials were committed in the prior two years, with 12,242 attributed to 2025.
文章将这些发现呈现为一项安全暴露研究，而非确认被滥用的证据。
The article presents the findings as a security exposure study, not as evidence of confirmed misuse.