Over 10 Thousand Docker Hub Images Leak Credentials and API Keys: What You Need to Know

Hello HaWkers, an alarming discovery is shaking the developer community: security researchers found more than 10 thousand images on Docker Hub exposing sensitive credentials, including API keys from services like OpenAI, AWS, HuggingFace and even bank credentials.

If you work with containers, this news should make you pause and review your security practices immediately. Let us understand what happened, who was affected and, most importantly, how to prevent this from happening to you.

What Was Discovered

Researchers from threat intelligence company Flare scanned container images uploaded to Docker Hub in November 2025 and found a concerning scenario.

Leak Numbers

Total Exposures:

10,456 images exposing at least one sensitive key
42% of compromised images exposed 5 or more secrets
101 companies identified with leaked credentials
Including a Fortune 500 company and a major national bank

Types of Exposed Secrets:

4,000 access tokens for AI models (OpenAI, HuggingFace, Anthropic, Gemini, Groq)
Production database credentials
AWS access keys
GitHub tokens
CI/CD system credentials
Payment integration keys

How This Happens

Secret exposure in Docker images is not a Docker Hub bug - it is a human error that happens in several ways:

1. .ENV Files Included in the Image

The most common error is including .env files directly in the image:

# ❌ WRONG - Never do this!
FROM node:20-alpine
WORKDIR /app
COPY . .
# The .env file with your credentials was copied!
RUN npm install
CMD ["npm", "start"]

The problem is that COPY . . copies EVERYTHING, including your .env file with credentials.

2. Hardcoded Credentials

Another frequent error is putting credentials directly in code:

# ❌ WRONG - Hardcoded credentials
import openai

openai.api_key = "sk-proj-abc123..."  # Exposed in the image!

def get_completion(prompt):
    response = openai.ChatCompletion.create(
        model="gpt-4",
        messages=[{"role": "user", "content": prompt}]
    )
    return response.choices[0].message.content

3. Credentials in Configuration Files

Files like config.json, settings.yaml or .npmrc often contain secrets:

{
  "database": {
    "host": "prod-db.company.com",
    "user": "admin",
    "password": "SuperSecret123!"
  },
  "api_keys": {
    "stripe": "sk_live_abc123...",
    "sendgrid": "SG.xyz789..."
  }
}

Why 75% of Credentials Were Not Revoked

An alarming finding from the research: even when developers noticed the error and removed the credential from the image, 75% of the time the key was not revoked.

The Docker Layer Problem

This happens because Docker uses a layer system. Even if you remove a file in a later layer, it still exists in previous layers:

FROM node:20-alpine
WORKDIR /app
COPY . .
# Credential copied in layer 3

RUN rm .env
# Removed in layer 4, but still exists in layer 3!

How Attackers Exploit This

# Attackers can inspect all layers
docker save image:tag -o image.tar
tar -xf image.tar
# Each folder is a layer - credentials can be in any of them

How to Protect Your Docker Images

Let us see the best practices to avoid this type of leak:

1. Use .dockerignore Religiously

Create a robust .dockerignore file:

# Environment files
.env
.env.*
*.env

# Credentials
.npmrc
.pypirc
credentials.json
service-account.json
*.pem
*.key
id_rsa*

# Local configurations
config.local.*
settings.local.*

# Git
.git
.gitignore

# IDE
.vscode
.idea
*.swp

2. Use Build Arguments for Build Secrets

If you need secrets only during build:

FROM node:20-alpine
WORKDIR /app

# Secret argument does not persist in final image
ARG NPM_TOKEN

# Use the secret and remove in the same layer
RUN echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > .npmrc && \
    npm install && \
    rm .npmrc

COPY . .
CMD ["npm", "start"]

Build with:

docker build --build-arg NPM_TOKEN=$NPM_TOKEN -t app .

3. Use Docker Secrets (Preferred)

For production, use Docker Secrets or an external manager:

FROM node:20-alpine
WORKDIR /app
COPY package*.json ./
RUN npm install
COPY . .

# Credentials will come via Docker Secrets at runtime
CMD ["npm", "start"]

In docker-compose:

version: '3.8'
services:
  app:
    image: my-app
    secrets:
      - db_password
      - api_key
    environment:
      - DB_PASSWORD_FILE=/run/secrets/db_password
      - API_KEY_FILE=/run/secrets/api_key

secrets:
  db_password:
    external: true
  api_key:
    external: true

4. Multi-Stage Builds

Use multi-stage builds to ensure build files do not leak:

# Stage 1: Build
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
ARG NPM_TOKEN
RUN echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > .npmrc && \
    npm ci && \
    rm .npmrc
COPY . .
RUN npm run build

# Stage 2: Production - clean image
FROM node:20-alpine AS production
WORKDIR /app
# Copy ONLY what is needed from builder
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
COPY package*.json ./

USER node
CMD ["npm", "start"]

5. Scan Your Images

Integrate secret scanning in your CI/CD:

# GitHub Actions example
name: Security Scan

on: [push, pull_request]

jobs:
  scan-secrets:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Scan for secrets with Trivy
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'table'
          exit-code: '1'
          severity: 'HIGH,CRITICAL'

      - name: Build image
        run: docker build -t app:${{ github.sha }} .

      - name: Scan image
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'app:${{ github.sha }}'
          format: 'table'
          exit-code: '1'

Detection Tools

There are several tools to detect leaked secrets:

Trivy (Recommended)

# Scan directory
trivy fs --scanners secret .

# Scan image
trivy image my-image:tag

Gitleaks

# Scan repository
gitleaks detect --source .

# Scan in pre-commit
gitleaks protect --staged

TruffleHog

# Scan git repository
trufflehog git file://. --only-verified

What to Do If You Leaked Credentials

If you discovered your credentials were exposed, follow this checklist:

Immediate Actions

Revoke the credential immediately - do not just remove from image
Generate new credentials with minimum permissions
Audit logs to identify unauthorized use
Notify your security team

Long-term Actions

Implement automatic rotation of credentials
Adopt a vault (HashiCorp Vault, AWS Secrets Manager, etc.)
Configure alerts for leak detection
Train your team on secure practices

Most Affected Industries

The research identified interesting patterns about who leaks credentials the most:

By Sector:

Software Development: highest number of leaks
Marketing and Industrial: second place
AI and Intelligent Systems: third place
Financial and Banking: more than 10 companies affected

Leak Origins:

"Shadow IT" accounts (outside corporate monitoring)
Developer personal accounts
Contractor and third-party accounts

Conclusion

The leak of more than 10 thousand Docker images with exposed credentials is an important reminder: security is the responsibility of all developers, not just the security team.

The good news is that preventing this type of leak is relatively simple with correct practices: use .dockerignore, never hardcode credentials, use secrets managers, and scan your images regularly.

If you have not yet reviewed your Docker images and CI/CD pipeline, now is the time. A leaked credential can cost from access to paid APIs to compromising your entire company infrastructure.

To understand more about modern infrastructure best practices, I recommend checking out the article Edge Computing and Serverless in 2025 where we discuss how new architectures can help improve security.

Lets go! 🦅

📚 Want to Deepen Your JavaScript Knowledge?

This article covered container security, but understanding JavaScript deeply is essential for any modern developer.

Developers who invest in solid, structured knowledge tend to have more opportunities in the market.

Complete Study Material

If you want to master JavaScript from basics to advanced, I have prepared a complete guide:

Investment options:

1x of $4.90 on card
or $4.90 at sight

👉 Learn About JavaScript Guide

💡 Material updated with industry best practices