This cross-sectional prevalence study measured the occurrence of credential leakage in undergraduate open-source projects hosted on public GitHub repositories collected on September 27, 2025. The main goal was to determine the rate at which the repositories showed sensitive credentials in the projects started on or after January 1, 2023. Candidate repositories were identified using tailored search queries combining undergraduate project indicators with backend and database keywords, and a minimum size threshold of 3MB was applied to filter the results. Fifty repositories that fulfilled specific inclusion criteria were selected. The information and metadata were accessed through the GitHub REST API v4 and the repositories were shallow-cloned and inspected locally. Gitleaks v8.21.2 and TruffleHog v3.82.6 were used to detect secrets. Provenance was stored in metadata and raw API outputs in the form of JSON files. A rubric based on CVSS generated repository-level risk scores between 0 and 6. Outputs were hashed, and secret strings were redacted. Where necessary, descriptive statistics, Wilson 95 percent confidence intervals, and chi-square or Fisher exact tests were used. Findings showed that 31 out of 50 repositories, or 62.0%, 95% confidence interval: 48.15 -74.14, had one or more leaked secrets. The analysis identified 325 cases of secret leakage; the majority of them were database-related credentials (n= 209, 64.3 percent), then the source-control keys (n= 65, 20.0 percent), and the cloud/API tokens (n= 51, 15.7 percent). The risk level of the repositories was categorized into High (n=15), Medium (n=16), or Low (n=19). The leakage was not significantly related to programming language (χ² = 4.27, df = 7, p = 0.749). The results show that credential leakage is prevalent in student repositories and usually includes high-impact secrets. It is suggested to implement curricular and operational interventions, such as the implementation of secure-by-default assignment templates, secret scanning, environment-based configuration, and institutional remediation and rotation processes.
Cabasa et al. (2025) studied this question.