Truffle Security: 543,699 GitHub credentials still active

Truffle Security scanned The Stack v3 dataset of 224.5 million GitHub repositories and found 543,699 unique credentials that still authenticated successfully in July 2026. The median exposed credential had been public for 784 days, 10% were over 6.3 years old, and the oldest working one dated to June 2009.

• 224,553,295 GitHub repositories and 58.4 billion files scanned
• 543,699 credentials still authenticated when tested in July 2026
• 51.8% of active secrets are types GitHub does not block by default
• 11,465 of 12,985 PostgreSQL connection strings still active (88%)