# Personal GitHub Repositories Are a Major Blind Spot for Corporate Secret Leaks (Wiz Research)

> Wiz Research's State of SDLC Security 2026 report finds that 56% of company-impacting secrets live in employees' personal GitHub repositories, outside corporate secret-scanning visibility, building on Wiz's earlier finding that 65% of the Forbes AI 50 had verified leaked secrets and that four of the top five most-leaked validated secret types belong to AI services.

- **Published:** 2026-08-13T00:00:00Z
- **Last reviewed:** 2026-08-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2009
- **ID:** TL-2026-2009
- **Severity:** MEDIUM
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Wiz Research's 'Closing the Blind Spot: Securing Personal Repositories in the Software Supply Chain' blog post (2026-08-13) reports that in its State of SDLC Security 2026 study, 56% of secrets with confirmed company impact were discovered not in corporate repositories but in the personal GitHub repositories of company employees and contributors -- a surface that sits entirely outside the boundary most organizations scan. This is a structural exposure rather than a single exploited vulnerability: there is no CVE, no named intrusion, and no confirmed breach tied to this finding. The risk is that corporate secret-scanning programs are scoped to org-owned repos, so credentials committed to an employee's side project, fork, gist, or notebook go undetected until an opportunistic actor finds them. Wiz's methodology is identity-driven correlation: it inventories developer identities and the personal public repositories they own, then uses the Wiz Security Graph to map attack paths from a leaked secret to exploitable cloud/SaaS resources, and validates real-world exploitability with 'Red Agent,' an AI-powered attacker-simulation tool. Findings are tracked down to the exact commit, GitHub user, and pushing email for accountability.

The August 2026 post builds directly on Wiz's prior research into the same blind spot. In November 2025, Wiz published 'Forbes AI 50 Leaking Secrets,' which scanned the Forbes AI 50 list (companies including OpenAI, Anthropic, Perplexity, Anysphere, Speak, and xAI, among others) using three techniques standard scanners miss: Depth (full commit history, commit history on forks, deleted forks, workflow logs, gists), Perimeter (org members' and contributors' personal repositories, followers, and accounts referencing the company name -- correlated using GHArchive data plus activity on Hugging Face and npm), and Coverage (AI-specific secret formats). That scan found verified secret leaks at 65% of Forbes AI 50 companies with a GitHub presence -- collectively valued at over $400 billion -- and that four of the top five most-leaked validated secret types were credentials for AI services rather than traditional cloud/CI-CD providers. LangChain (multiple LangSmith API keys leaked across .py, .ipynb, and .env files, including an organization-level 'enterprise_legacy' key granting 'org:manage' and 'org:read' scopes that allowed listing of the organization's members) and ElevenLabs (an enterprise-tier API key leaked in plaintext inside an mcp.json file) were named as confirmed sources of leaked secrets; at least one additional, unnamed AI50 company leaked a Hugging Face token via a deleted fork exposing roughly 1,000 private models, alongside Weights & Biases API keys that exposed private-model training data. Wiz notes exposure was uneven across the set -- the smallest exposed company had 0 public repos and 14 org members, while the largest company Wiz checked without exposure had 60 public repos and 28 org members.

Wiz's companion research ('AI Secret Leaks in Public Code Repos,' June 2025) found that 4 of the top 5 most common secret types overall were AI-related (Hugging Face, AzureOpenAI, Weights & Biases, Postgres, and AlgoliaAdminKey led the list), that roughly 40% of discovered secrets had confirmed company impact, that over 30 companies/startups -- including multiple Fortune 100 entities -- had validated leaked secrets, and that around 20% of checked organizations had exposed secrets. It identified Python/Jupyter notebooks (.ipynb) as the single highest-density leak vector via three mechanisms: hardcoded secrets embedded directly in code cells or comments; interactive cell-output disclosure, where simply printing a variable (or calling diagnostic functions like show() or list()) echoes a loaded credential even when it was sourced correctly from an environment variable; and stack-trace/error-message leakage exposing local filesystem and networking details. It also flagged Model Context Protocol (mcp.json) configuration files as a newer, growing leak vector: the popular MCP server 'Taskmaster AI' (11k+ GitHub stars) and even GitHub's own official MCP server were both found recommending hardcoding credentials directly into mcp.json, a pattern that impacts OpenAI and Anthropic customers who adopt it. That research also documented a long tail of additional AI-service secret types leaking in the wild -- Perplexity, Groq, NVIDIA and NVIDIA-NGC, Tavily, Cohere, Pinecone, Clarifai, Gemini, AI21 Labs, IBM Watsonx AI, Cerebras, FriendliAI, FireworksAI, and TogetherAI -- plus dramatically unaddressed credential leakage tied to Chinese 'AI Tiger' platforms (Zhipu AI, Moonshot AI, Baichuan Intelligence, 01.AI, StepFun, and MiniMax) that fall outside the coverage of Western secret-scanning tools built around commodity cloud-provider patterns.

The broader State of SDLC Security 2026 report (May 2026) situates the personal-repo finding inside a wider set of SDLC risk trends: 86% of developer platforms run macOS, concentrating the developer attack surface on a standardized environment; 45-50% of organizations run CI/CD automation on GitHub Actions, which Wiz notes combines execution, credentials, and automation at scale into a direct path from development access to production impact; dependency adoption follows a power-law distribution so risk concentrates in a small set of widely-reused packages; and roughly 1 in 5 organizations using AI-powered development platforms had applications affected by systemic security issues as of September 2025 research, with Wiz assessing that AI accelerates existing SDLC weaknesses (faster code generation, broader reuse before review) rather than introducing categorically new ones.

The practical risk documented across this research line is that leaked secrets are not a passive finding: Wiz reports that threat actors run bots that monitor public commit activity in near real time, and that exposed secrets can be picked up and exploited within minutes -- sometimes seconds -- of being pushed. Unlike typical developer-tool API keys, the AI-service credentials found frequently grant infrastructure-level access rather than narrow application-scoped access -- direct platform access to observability/experiment-tracking data, private-model access and manipulation, training-data extraction, organizational-structure exposure (which Wiz calls 'highly valuable' reconnaissance for an attacker), and compromised workflow/CI-CD pipeline access -- creating a path to private model weights, proprietary training data, and internal organizational structure. Disclosure friction compounds the exposure: across Wiz's Forbes AI 50 outreach, roughly half of responsible-disclosure attempts (via email, LinkedIn, and X) went unanswered or failed to reach the affected company, reflecting that many AI startups still lack a formal vulnerability-disclosure channel.

## MITRE ATT&CK

- T1593.003 Search Open Websites/Domains: Code Repositories
- T1552.001 Unsecured Credentials: Credentials In Files
- T1078.004 Valid Accounts: Cloud Accounts
- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1213.003 Data from Information Repositories: Code Repositories
- T1119 Automated Collection
- T1530 Data from Cloud Storage
- T1526 Cloud Service Discovery
- T1087.004 Account Discovery: Cloud Account
- T1069.003 Permission Groups Discovery: Cloud Groups
- T1565.001 Data Manipulation: Stored Data Manipulation

## Sources

- [Closing the Blind Spot: Securing Personal Repositories in the Software Supply Chain](https://www.wiz.io/blog/securing-personal-repositories)
- [State of SDLC Security 2026: How Risk Scales](https://www.wiz.io/blog/sdlc-security-report-2026-key-takeaways)
- [State of SDLC Security 2026 (report)](https://www.wiz.io/reports/sdlc-security-report-2026)
- [65% of Startups from Forbes AI 50 Leaked Secrets on GitHub](https://www.wiz.io/blog/forbes-ai-50-leaking-secrets)
- [AI Secret Leaks in Public Code Repos: Warning to Developers](https://www.wiz.io/blog/leaking-ai-secrets-in-public-code)
- [Many Forbes AI 50 Companies Leak Secrets on GitHub](https://www.securityweek.com/many-forbes-ai-50-companies-leak-secrets-on-github/)
- [GitHub is awash with leaked AI company secrets](https://www.itpro.com/security/github-is-awash-with-leaked-ai-company-secrets-api-keys-tokens-and-credentials-were-all-found-out-in-the-open)
- [AI startups leak sensitive credentials on GitHub, exposing models and training data](https://www.csoonline.com/article/4087983/ai-startups-leak-sensitive-credentials-on-github-exposing-models-and-training-data.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2009