API Keys in Your Code: How Developers Accidentally Expose Secrets Worth Thousands
Git history never forgets. A secret committed once stays forever — even after deletion. Bots scan GitHub 24/7 and find your keys within minutes of a push.
Vlad Piskun
Security Researcher, Teyna
In October 2022, a security researcher discovered that Toyota had accidentally published an access key to a cloud system on a public GitHub repository — and left it there for nearly five years. During that time, the exposed key gave potential access to location data for 2 million Toyota customers. The company's response: they immediately revoked the key when notified. The root cause: a developer committed a configuration file containing credentials, and nobody caught it for 1,800 days.
What Kinds of Secrets End Up in Code?
Developers accidentally commit secrets constantly. The most dangerous types found in production codebases:
Cloud credentials
criticalAWS Access Key ID + Secret, GCP service account JSON, Azure connection strings
Full cloud infrastructure access — spin up servers, access databases, read all storage buckets
Payment API keys
criticalStripe secret key (sk_live_...), PayPal client secret, Braintree private key
Process refunds, read customer payment history, create charges
Database connection strings
criticalmongodb+srv://user:pass@cluster, postgresql://user:pass@host/db
Direct database read/write access — dump all customer data
Communication API keys
highTwilio Auth Token, SendGrid API key, Mailgun private key
Send messages/emails as your brand, read message history, incur billing
Internal service tokens
highJWT secrets, session signing keys, internal service passwords
Forge authentication tokens, impersonate any user
Git History Never Forgets
The most dangerous misconception: "I deleted the file, so it's gone." Git stores the entire history of every file. Even if you delete a secret and push the deletion, the original commit containing the secret is still in the repository history — permanently accessible to anyone with repo access.
# A developer accidentally commits .env with secrets git add .env git commit -m "add config" git push origin main # Realizes the mistake, deletes and pushes git rm .env git commit -m "remove config" git push origin main # The secret is STILL in the repo history: git log --all --full-history -- .env git show abc123:.env # original file with secrets, fully visible
The only proper fix is to rewrite git history with git filter-branch or BFG Repo Cleaner — and immediately rotate every exposed credential, assuming it was already compromised.
Bots Find Your Keys in Minutes
Within seconds of a git push to a public repository, automated bots scan for known secret patterns. Researchers have documented cases where AWS keys were found and used within 4 minutes of being pushed. GitHub's own Secret Scanning feature — which runs on all public repos — found over 1 million secrets in 2023 alone. The attackers running these bots don't need to target you specifically: they scrape everything, store it, and use it later.
Your secrets might already be on a hacker's list
Toyota's key sat on GitHub for 5 years. Most companies don't find out until a researcher — or an attacker — tells them.
Teyna scans your JS bundles, API responses, and historical URLs for exposed credentials.
Scan my site now →Free tier available. Enterprise plans from $299.
Real-World Cases
Impact
Location data of 2M customers potentially exposed
Cost
Regulatory investigation, reputational damage
An AWS access key was committed to a public GitHub repository in December 2017 and remained there until October 2022 — nearly 5 years. The key provided access to a system containing vehicle location data for 2 million Toyota customers in Japan. Reuters reported the incident after a security researcher discovered the exposure.
Reuters — Toyota data breachImpact
Internal source code and credentials leaked on GitHub
Cost
Confidential IP exposed, security audit required
Samsung employees uploaded internal source code — including credentials and private keys — to public GitHub repositories. The leaked repositories contained code related to Samsung's SmartThings platform and internal DevOps tooling. The incident highlighted how BYOD policies and inadequate secret scanning create systematic exposure risk.
BleepingComputer — Samsung leakImpact
1,000,000+ secrets found in public repositories
Cost
Industry-wide exposure across all providers
GitHub's own Secret Scanning — which automatically scans all public repositories for known secret patterns — detected and notified developers about over 1 million secrets in 2023. This includes API keys for AWS, Google, GitHub itself, Stripe, Twilio, and hundreds of other providers. The actual number of undetected or private-repo secrets is far higher.
GitHub Security Blog — Secret Scanning 2023Why 'Public' Keys Are Still Dangerous
Some developers believe that keys in frontend JavaScript are "safe" because they're "public anyway." This is wrong for most key types. A Stripe publishable key (pk_live_...) is genuinely public — it's designed to be in frontend code. But a Stripe secret key (sk_live_...) in your JS bundle can process refunds and read all customer data. A Firebase API key in your frontend is fine for client SDK — but if your Firebase Security Rules are misconfigured, it becomes a direct database key. Google Maps API keys restricted to your domain are low-risk — but unrestricted ones can incur unlimited billing charges. The rule: assume every key you ship in frontend code will be found, tested, and abused.
How Teyna Detects Exposed Secrets
Teyna scans your application for exposed secrets across multiple surfaces — not just source code, but also compiled JS bundles, API responses, and historical URLs.
JS bundle analysis
Teyna downloads and scans your production JavaScript bundles for 200+ known secret patterns: AWS key format, Stripe key prefixes, database URL schemas, JWT secrets, and custom regex patterns.
Historical URL scanning (gau)
Using gau (GetAllUrls), Teyna finds historically exposed endpoints from the Wayback Machine and Common Crawl — including old JS files that may still contain secrets even if removed from production.
TruffleHog integration
TruffleHog scans for high-entropy strings and known secret formats with verified detection — distinguishing real credentials from false positives by checking key format validity.
API response scanning
Teyna crawls your application and scans API responses for accidentally returned secrets — internal tokens, connection strings, or service credentials leaked in JSON responses.
Git history analysis (when applicable)
For code repositories connected to the scan target, Teyna can analyse git history for secrets that were committed and deleted but remain in history.
5 Steps to Eliminate Secret Exposure
Never commit secrets — use environment variables
All credentials belong in environment variables, not source code. Use .env files locally (and add .env to .gitignore immediately), but deploy using platform environment variable storage: Vercel Environment Variables, AWS Parameter Store, HashiCorp Vault, or GitHub Actions Secrets.
Add .gitignore before the first commit
Add .gitignore before you ever run git add. A common mistake: creating the project, committing everything including config files, then adding .gitignore. By then the secrets are already in history. Use gitignore.io to generate a complete .gitignore for your stack.
Rotate immediately if you think a secret was exposed
Don't investigate first — rotate first. The moment you suspect a key was exposed, revoke it and issue a new one. Assume it was found and used. Then investigate. AWS, Stripe, Twilio, and most providers allow instant key rotation with zero downtime.
Clean git history with BFG Repo Cleaner
If secrets are in git history, use BFG Repo Cleaner (faster than git filter-branch) to rewrite history and remove them: bfg --delete-files .env && git reflog expire --expire=now --all && git gc --prune=now. Then force-push and notify all collaborators to re-clone.
Enable secret scanning in your CI/CD pipeline
Add secret scanning to your pre-commit hooks and CI pipeline so secrets are blocked before they're pushed. Tools: git-secrets (AWS), detect-secrets (Yelp), truffleHog, or GitHub Advanced Security Secret Scanning for private repos.
Check if your site is leaking API keys or credentials
Teyna scans your JS bundles, API responses, and historical endpoints for exposed secrets.
Most secret exposures are found in production JS bundles — code that ships to every visitor.
Start free scan →No installation. No credit card. Results in 30 minutes.