Threat intelligence company Flare said it identified exposed credentials in 10,456 public Docker Hub container images uploaded between November 1 and November 30, 2025. The findings included live credentials for production systems, cloud services and software development infrastructure, the company said.
Flare linked the exposures to 101 organizations, primarily small and medium-sized businesses, but also a Fortune 500 company and a major national bank. Docker Hub hosts container images that developers use to package and distribute applications and their dependencies.
Approximately 42% of images containing exposed secrets held at least five sensitive values each, the researchers found. Flare said these combinations could provide access to cloud environments, Git repositories, continuous integration and delivery systems, payment integrations and other infrastructure.
Almost 4,000 AI service keys exposed
Flare said AI service access tokens were the most frequently exposed credential category. A search limited to high- and critical-severity findings from the November uploads identified almost 4,000 AI keys, including credentials for OpenAI, Hugging Face, Anthropic, Gemini and Groq.
The researchers examined image manifests and downloaded and unpacked container images to scan their files. Their initial search covered 15 credential types across development tools, cloud platforms and AI services, a selection Flare described as representative rather than exhaustive.
After excluding findings below high or critical severity, the team investigated 205 Docker Hub namespaces and associated 101 of them with identifiable companies. Flare’s analysis found that software development businesses accounted for most of the identified organizations, which also included more than 10 finance and banking companies.
Secrets appeared in files and image metadata
Common sources of exposure included .env files containing database credentials, cloud access keys and authentication tokens, the researchers said. They also found AI API keys hardcoded in Python files, config.json files and YAML configuration files, as well as GitHub tokens and credentials for internal environments. Some sensitive values appeared in image metadata that Flare described as manifests.
Flare identified employees, founders, freelancers and contractors publishing company secrets through personal Docker Hub accounts. The company described a significant portion of the leaks as originating from shadow IT accounts outside corporate monitoring and security controls.
Deleting a secret did not always invalidate it
Flare said roughly 25% of developers who exposed secrets removed them from the container image or manifest within 48 hours. In about 75% of those removal cases, however, the underlying key was not revoked. An active credential could still be used by someone who had copied it during the exposure.
The company recommended revoking exposed credentials, invalidating old sessions, using short-lived credentials and centralized secret stores, and scanning throughout the software development lifecycle, including container images.
Docker’s documentation warns that build arguments and Dockerfile environment variables are unsuitable for passing build secrets because sensitive values can persist in the resulting image or its metadata. It directs developers to use secret mounts or SSH mounts for credentials needed during a build.
