npm had one live token left out of 101,886. Postgres had 11,465 out of 12,985. The difference is not push protection
2026-10-05Security
Truffle Security scanned 224.6 million public GitHub repositories from an AI training dataset and found 543,699 credentials that still worked. The survival rate by provider is the finding: where a provider scans for its own leaked tokens and kills them, almost nothing survives. Where it does not, almost everything does.