As cited
Copy frozen at (site build).
threat intel
Hardcoded MCP credentials found in public GitHub files
Hush Security analyzed approximately 82,000 Model Context Protocol (MCP) configuration files on GitHub and identified hardcoded credentials in roughly 12% of them, including application programming interface (API) keys, access tokens, and other secrets for connected services. These exposed credentials were discoverable in publicly accessible files, creating potential pathways for unauthorized access to downstream systems.
Why it matters: Developers and organizations using MCP-integrated artificial intelligence (AI) coding tools face credential exposure risk today; security teams should audit their GitHub repositories and connected service accounts for hardcoded secrets and revoke any discovered credentials.
- Source published
- First seen by Cybersecurity Tracker