{"id":183679,"date":"2026-10-07T22:54:32","date_gmt":"2026-10-07T20:54:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/v-github-vyyavleno-543-tysyachi-ostavlennyh-v-repozitoriyah-dejstvuyushhih-tokenov-klyuchej-i-parolej"},"modified":"2026-10-07T22:54:38","modified_gmt":"2026-10-07T20:54:38","slug":"543000-active-tokens-keys-and-passwords-found-in-github-repositories","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/543000-active-tokens-keys-and-passwords-found-in-github-repositories","title":{"rendered":"Na GitHubu prona\u0111eno 543 tisu\u0107e aktivnih tokena, klju\u010deva i lozinki ostavljenih u repozitorijima","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Tvrtka Truffle Security objavila je rezultate analize curenja vjerodajnica u repozitorijima smje\u0161tenim na GitHubu. Tijekom skeniranja 224 milijuna repozitorija, koji sadr\u017ee 58 milijardi datoteka, otkriveno je 543 tisu\u0107e jedinstvenih vjerodajnica (tokena, klju\u010deva i lozinki) koje su i dalje aktivne. Aktivne vjerodajnice nalazile su se u repozitorijima najmanje godinu dana, budu\u0107i da je u istra\u017eivanju kori\u0161tena snimka stanja GitHuba od 7. kolovoza pro\u0161le godine, a provjera a\u017eurnosti vjerodajnica, provedena putem probnih poziva API-ju, mre\u017enim uslugama i hostovima, izvr\u0161ena je krajem srpnja ove godine. <\/p>\n

Medijan vremena tijekom kojeg su vjerodajnice bile javno dostupne procijenjen je na 784 dana, pri \u010demu su najstariji jo\u0161 uvijek aktivni klju\u010devi pristupa datirani iz 2009. godine. Oko 200 tisu\u0107a prona\u0111enih aktivnih vjerodajnica dodano je u repozitorije nakon \u0161to je zadano omogu\u0107eno na GitHubu mehanizam za blokiranje curenja povjerljivih podataka i pristupnih tokena, koji provodi provjeru prilikom slanja push zahtjeva. Curenja nisu prepoznata zbog smje\u0161taja u formatima koji nisu podr\u017eani u implementiranoj za\u0161titi, dok je izravno uklju\u010divanje filtara smanjilo curenja prepoznatih vjerodajnica otprilike dva puta. <\/p>\n

Ispostavilo se da GitHub uspje\u0161no otkriva curenja tokena za popularne usluge, kao \u0161to su GitHub, AWS, Slack, SendGrid, Stripe i GCP, ali propu\u0161ta ostavljene u kodu parametre za povezivanje s bazom podataka, pristupne klju\u010deve za Google API i privatne klju\u010deve. Parametri za povezivanje s bazom podataka i privatni klju\u010devi prema zadanim postavkama nisu blokirani kako bi se izbjegla la\u017ena pozitivna o\u010ditavanja. Pristupni klju\u010devi za Google API nisu blokirani jer imaju prefiks AIzaSy, kao otvoreni klju\u010devi za Google Maps, namijenjeni integraciji na web-stranice. <\/p>\n

\u0160to se ti\u010de prona\u0111enih korisni\u010dkih podataka koji su se pokazali neispravnim, ve\u0107i dio njih odnosi se na pristupne tokene i klju\u010deve povezane s uslugama koje pru\u017eaju mehanizam opoziva. Na primjer, od 101886 NPM tokena otkriven je samo jedan aktivan (0.001%), od 73048 GitHub tokena \u2014 260 (0.35%), a od 30437 tokena Hugging Face \u2014 15 (0.05%). Za klju\u010deve Stripe postotak pre\u017eivljavanja iznosi 4%, AWS \u2014 8%, GCP \u2014 8%, Slack \u2014 2%, GitLab \u2014 0.64%. U usporedbi, od 12985 prona\u0111enih parametara veze za PostgreSQL, 11465 ostaje aktivno (88%), od 2421 parametara veze za MySQL \u2014 1806 (74%), od 126963 servisnih ra\u010duna Google Clouda \u2014 69041 (54%), od 3790 tokena za Docker Hub \u2014 1244 (33%), a od 22800 klju\u010deva za SendGrid \u2014 9189 (40%). <\/p>\n

Prije toga, istra\u017eiva\u010di su analizirali oko 7,5 PB podataka za obuku AI modela, distribuiranih putem Hugging Face, i prona\u0161li 221 tisu\u0107u aktivnih korisni\u010dkih podataka.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Truffle Security \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0443\u0442\u0435\u0447\u0435\u043a \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u0445 \u043d\u0430 GitHub. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f 224 \u043c\u043b\u043d \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0445 58 \u043c\u0438\u043b\u043b\u0438\u0430\u0440\u0434\u043e\u0432 \u0444\u0430\u0439\u043b\u043e\u0432, \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 543 \u0442\u044b\u0441\u044f\u0447\u0438 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 (\u0442\u043e\u043a\u0435\u043d\u043e\u0432, \u043a\u043b\u044e\u0447\u0435\u0439 \u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439), \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0449\u0438\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u0442\u044c. \u0414\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0438\u0441\u044c \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0433\u043e\u0434, \u0442\u0430\u043a \u043a\u0430\u043a \u0432 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f \u0441\u0440\u0435\u0437 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f GitHub \u043e\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183679","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Na GitHubu je otkriveno 543 tisu\u0107e aktivnih tokena, klju\u010deva i lozinki ostavljenih u repozitorijima | ProHoster","description":"Tvrtka Truffle Security objavila je rezultate analize curenja korisni\u010dkih podataka iz repozitorija smje\u0161tenih na GitHubu.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/543000-active-tokens-keys-and-passwords-found-in-github-repositories","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 GitHub \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 543 \u0442\u044b\u0441\u044f\u0447\u0438 \u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0442\u043e\u043a\u0435\u043d\u043e\u0432, \u043a\u043b\u044e\u0447\u0435\u0439 \u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Truffle Security \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0443\u0442\u0435\u0447\u0435\u043a \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u0445 \u043d\u0430 GitHub.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/543000-active-tokens-keys-and-passwords-found-in-github-repositories","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-07T20:54:33+00:00","article:modified_time":"2026-10-07T20:54:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/183679","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=183679"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/183679\/revisions"}],"predecessor-version":[{"id":183680,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/183679\/revisions\/183680"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=183679"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=183679"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=183679"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}