BleepingComputer's review of public code repositories found more than 9,300 AWS access keys exposed between August 2022 and August 2026 that remain valid today, each one capable of full account takeover under whatever IAM policy it was issued with. The keys turned up hardcoded in commits, CI config, and mobile app binaries, some four years old, none rotated. AWS access keys do not expire on their own. A key committed in 2022 works in 2026 unless someone deletes it, which is the entire finding.

The gap is between what AWS's shared responsibility model assumes and what a four-year-old commit history actually does. AWS scans public repositories for exposed keys and notifies account owners, a control that has existed since 2015. It caught these commits. It did not make anyone rotate the keys. For a CISO whose org has any engineering team with GitHub access, the actionable item is not a scan, it is a mandate: 90-day key rotation enforced by IAM policy (MaxSessionDuration and credential-expiry conditions), not by a ticket someone can snooze for four years.