This guest post by independent security researcher Ben Zimmermann was developed in collaboration with the Kingfisher team at MongoDB. Ben specializes in large-scale credential exposure research across public source-hosting platforms.

TL;DR: I scanned 7,256,531 public repositories on Gitee (China's largest indigenous Git hosting platform), using both TruffleHog and Kingfisher, and found 26,400 unique verified-live credentials. Findings included an active organization-admin credential for a major enterprise AI platform and thousands of live cloud provider access keys.

Gitee, launched in 2013 by OSChina, was selected by China's Ministry of Industry and Information Technology as the country's national open-source code hosting platform. Its public API is severely constrained relative to GitHub and GitLab: no paginated projects endpoint, and the on-site code-search feature appears to have been retired years ago. A.css-1x185kz{font-family:Sohne,Noto Sans KR,Noto Sans SC,Noto Sans JP;font-weight:500;cursor:pointer;-webkit-text-decoration:none;text-decoration:none;display:inline;font-size:inherit;line-height:32px;color:#006cfa;}.css-1x185kz:hover{-webkit-text-decoration:none;text-decoration:none;}.css-1x185kz span{display:inline;}.css-v8ucxo{display:-webkit-box;display:-webkit-flex;display:-ms-flexbox;display:flex;-webkit-align-items:center;-webkit-box-align:center;-ms-flex-align:center;align-items:center;text-align:left;}.css-v8ucxo .textlink-default-text-class{color:#006cfa;border-bottom:2px solid transparent;font-size:inherit;}.css-v8ucxo .textlink-default-text-class:hover{border-bottom:2px solid #21313a;}.css-v8ucxo .textlink-arrow-class{color:#001e2b;line-height:32px;}.css-v8ucxo .textlink-link-icon-class{color:#001e2b;line-height:32px;}.css-zqal5z{display:-webkit-box;display:-webkit-flex;display:-ms-flexbox;display:flex;-webkit-align-items:center;-webkit-box-align:center;-ms-flex-align:center;align-items:center;font-size:16px;line-height:32px;color:#006cfa;}.css-zqal5z:hover{-webkit-text-decoration:none;text-decoration:none;} 2021 attempt to study credential exposure on Gitee concluded that its APIs were too limited to scale the research.