Independent security researcher Ben Zimmermann, in a guest post developed with MongoDB's Kingfisher team and published on MongoDB's blog on 28 October 2026, says he scanned 7,256,531 public repositories on Gitee, which he describes as China's largest indigenous Git hosting platform, with both TruffleHog and Kingfisher and found 26,400 unique verified-live credentials.

He says both scanners authenticate each candidate against its vendor's API at scan time and the figure is deduplicated by secret value; TruffleHog found 12,737, Kingfisher 14,664 and 1,001 were caught by both.

Zimmermann says the findings included an active organization-admin credential for a major enterprise AI platform (not named) and thousands of live cloud provider access keys, that Alibaba Cloud AccessKey pairs were the most common type (roughly one in every 766 repositories), and that 2025 alone accounts for 12,242 of the credentials.

He says he emailed the vendors with the highest exposure volume with the full list of their credentials, did not notify individual committers, and that at the time of writing revocation status had not been confirmed. He puts Gitee's rate at 3.64 verified-live credentials per 1,000 repositories, against 3.11 for GitLab and 2.39 for Bitbucket in earlier TruffleSecurity scans, noting those scans used TruffleHog alone. (source: Ben Zimmermann, MongoDB blog)