.png)
Security researcher Ben Zimmermann scanned 7,256,531 public repositories on Gitee, China's largest Git platform, and discovered 26,400 unique verified-live credentials. The findings include an active organization-admin credential for a major enterprise AI platform and thousands of live cloud provider access keys. Gitee, launched in 2013 by OSChina, was selected by China's Ministry of Industry and Information Technology as the national open-source code hosting platform.
Its public API is severely constrained compared to GitHub and GitLab, with no paginated projects endpoint and a retired code-search feature. A 2021 attempt to study credential exposure on Gitee concluded that its APIs were too limited to scale the research. Like any large Git platform, Gitee is an attractive surface for credential exposure: it is Git-based, so secrets buried deep in commit history persist.
It hosts millions of public repositories with active commit volume and lacks the platform-vendor secret-scanning partnerships common on GitHub. Enumerating millions of Gitee repositories required combining many surfaces: the only official REST endpoint that returned useful data at scale, the platform's Explore feed, per-user repository and stargazer pages on the website itself, and Gitee's internal Elasticsearch widget that backs the on-site search UI. The single official REST endpoint that returned useful data at scale was GET /api/v5/search/users?q=.
Zimmermann hit it with three-character prefix queries (aaa, aab, ..., zzz) and combined the results with usernames extracted from the public Explore feed. He then expanded that set via each user's following list and the stargazers of popular repositories, producing a seed corpus of 1,704,759 usernames. With the username corpus in hand, two per-user pages yielded repositories: gitee.com/{user}/projects (a user's own repos) and gitee.com/{user}/stared_projects (repos the user has starred).
Page 1 of /projects returns full HTML; subsequent pages are AJAX-paginated. The stargazer-list pages used during username bootstrap paginate the same way, additionally requiring a CSRF token extracted from the page-1 HTML. A large fraction of the platform sits outside the social graph.
To reach it, Zimmermann used the same internal Elasticsearch endpoint that backs Gitee's on-site search UI: so.gitee.com/v1/search/widget/wong1slagnlmzwvsu5ya. It takes a query ID, a q parameter, and pagination via from + size. Each query returned at most 20 results per page, with a hard cap of 200 results total regardless of how many matches actually existed.
For specific usernames, this was usually fine; for common usernames and trigram prefix queries against the widget, the cap silently truncated results. The widget's response includes Elasticsearch aggregations that bucket results by language and license. For the per-user scrape, when a query was capped, Zimmermann split it by the language buckets the response already returned.
For trigram prefix queries against the widget, he extended this into a BFS over a query tree: capped nodes split first by language, then by license, then by deeper prefix until each branch fit within 200 results. After deduplicating repo IDs across all sources, this process yielded a comprehensive dataset.
Source: Hacker News · Summarized by HeadlinesBriefing