Someone will find your leaked credentials. We make sure it's us.
GitGuardian has spent years warning developers when credentials leak publicly. Now we go further: identifying the organizations behind high-impact leaks, assessing what those credentials can reach, and helping the warning reach the security team that can act.
%202.png)
.svg)
It started with a warning to the developer
GitGuardian’s original Good Samaritan program was built around a simple idea: if we see a developer accidentally expose a credential on public GitHub, we should tell them.
83M
secrets detected
11.9M
alert emails sent
5.9M
developers warned
Since 2018 we’ve been monitoring public GitHub for exposed secrets. But notification and revocation are not the same thing.
How the program works
Since 2018, GitGuardian’s Good Samaritan program has alerted developers when their secrets leak in public. But an enterprise leak needs more than an automated email. It needs attribution, escalation, and a responsible path to the people who can act.
We monitor public exposure at scale
We identify who the leak affects
.svg)
We reach out, responsibly
.svg)
The hard part is what happens after a warning
For an enterprise a warning often isn't enough.
The person who exposed the credential may not own it. They may not know what it can access. They may not have the authority to revoke it. And the security team responsible for the affected systems may never see the warning.
The result is that secrets can stay exposed long after they're discovered.
Of secrets valid in 2022 still valid four years later
New hardcoded secrets on public GitHub in 2025, up 34% year over year
Of valid secrets not revoked a week after the leaker was alerted
Enterprise Good Samaritan is built to get from alert to action
For high-impact credential exposures tied to an organization, our researchers add the context and escalation needed to drive remediation.
Public scan.
We monitor public exposure at scale.
AI attribution.
We identify who the leak affects.
Disclosure.
We reach out, responsibly.
Context your team can act on.
Every disclosure explains what the secret is, whether it's still valid, and its blast radius, the permissions it grants and the systems and data it can reach.
More people reached.
We contact multiple people inside the organization, not just the developer who pushed the commit.
A direct line to the security team.
For serious exposures, we work to reach the security team that can revoke the credential. When automated outreach goes unanswered, our researchers escalate manually.
.svg)
What can one leaked credential expose?
A secret is only as dangerous as the access behind it. For the high-impact leaks we investigate, we look beyond the existence of the credential to understand what could actually be exposed.
How escalation got the CISA leak offline in 26 hours
In May 2026, our monitoring flagged a public GitHub repository named Private-CISA, created by a contractor, containing 844 MB of sensitive government data including valid cloud credentials. Nine automated alerts had already been sent to the commit author but each one went unanswered. So our research team took a different approach: direct escalation through CERT/CC and established contacts at the relevant agencies. The repository came offline within 26 hours of that call.
Sensitive data plain-text passwords, cloud credentials, some still valid
Automated alerts sent, all unanswered
From human escalation to repository offline
The principles we disclose by
When we contact an organization about an exposed credential, we ask them to treat it with urgency, care, and accountability. We hold ourselves to that same standard.
Speed first
When we find a leak, we notify within hours, sometimes minutes.
No destructive actions, ever.
We confirm and assess. Nothing more.
We log every action
Every step is recorded and traceable.
Transparency
We document our disclosure process and hold ourselves to it.
Persistence
If the notification goes unanswered we follow up, we don't walk away.
Recognized for our disclosures
When GitGuardian's research team responsibly discloses leaked secrets, the organizations we contact sometimes credit us publicly. Our researchers are listed in the following security hall-of-fame and vulnerability-disclosure programs:
Make your organization reachable before a leak happens.
The hardest part of responsible disclosure is often finding someone to receive it. For exposed credentials, that path is not always clear. A serious disclosure can end up in a generic inbox, a contact form, or a bug-bounty process that was not designed for leaked secrets. Our ask to enterprises is simple: establish a clear, monitored channel for outside researchers to report exposed credentials, before you need it.
.svg)
Want to know what's already exposed?
You don't have to wait for us to find you. See the critical credential exposures GitGuardian can identify across your organization's public footprint, along with the context needed to understand which ones deserve immediate attention.
