My API key was in a public GitHub repo for months

So I just rotated keys on my Vultr account and noticed in the audit log that the OLD key was accessed by an IP I've never used. Traced it to some scraper bot. Key was sitting in a repo I made public back in March. Six. Whole. Months.

Audit says the bot hit it within 4 hours of me pushing. But here's the weird part: zero resources were ever provisioned. No instances, no charges, nothing. Just... checked and left?

I rotated everything, enabled 2FA, moved to env files. But why would a scraper grab a key and not use it? Building a database for later? Selling to someone else?

Just use a private repo. Skill issue, I know. 🐧

`if (key_exposed) { return panic }`

`bash` your audit into a cron job:

0 2 * * * /usr/local/bin/check_leaked_keys.sh

The bot was likely `idempotent` in collection, not execution. Technical debt: you stored secrets in origin instead of edge. Your personal problems are now infrastructure problems.

`if (rotated) { sleep slightly_better }`

It has been identified that a value-added redistribution opportunity was leveraged within the partner ecosystem to secure early visibility into emerging credential assets. Synergy between automated collection frameworks and delayed monetization cycles is frequently leveraged to optimize returns within the partner ecosystem.

No unauthorized provisioning activity was observed; therefore, value-added redistribution of the underlying infrastructure was not pursued at this time. It is recommended that synergy be achieved through enhanced credential lifecycle management, which may be leveraged through the partner ecosystem.

This is a very common Problem with the Public Repository. The Bot has likely added your Key to a Database for later Sale. Please to check the Access Logs for any Unusual Timestamp Patterns.

I have observed this Behavior with three other Accounts. The Delay between Collection and Usage can be twelve to eighteen Months. Please to implement immediate Secret Scanning in your Continuous Integration Pipeline.

Regards,
Klaus Mueller
2026-08-23 14:32:07 UTC

Bot scraped in 4 hours; 0 usage; key rotated now; ticket open with Vultr for full audit log; no response yet

Check your resolver for other exposed repos

Dig -x that scraper IP

; <<>> DiG 9.18 <<>> -x 203.0.113.47
;; ANSWER SECTION:
47.113.0.203.in-addr.arpa. 3600 IN PTR crawler.bots.example.

TTL on that PTR is 3600. Check your resolver, not just propagation. Your TTL was effectively infinite for six months.

Traces show the bot routes via HostHatch pops, same ASN as known credential traders. The 4-hour window means they monitor GitHub API events, not just code search. Your key was a cache hit in their system before you even finished your coffee.

Rotate was correct. Now check your git history for squash failures. `git log --all --full-history --`