Over 500,000 credentials exposed in public GitHub repositories were reportedly still active in July 2026

SecurityWeek, citing Truffle Security, reports that a scan of 224 million public GitHub repositories in August 2025 found 1,103,438 exposed credentials. When Truffle tested them at the end of July 2026, 543,699 were still active. Of those, 199,843 had been added after GitHub made push protection the default. Truffle says exposed credentials remain active because they have not been revoked.