Gerrit Code Review on the Open Internet: 2,508 Title Matches and the Credential Store Behind Them

Gerrit Code Review, an internet-reachable code review server, contains credentials for various systems and often serves as a credential store. It connects developers with Git repositories and manages review metadata. An internet-accessible Gerrit presents a significant asset measured through a title query for the product name. A query on 28 September 2026 yielded 2,508 matches, with 2,165 specific to "Gerrit Code Review."

This count indicates the number of internet-accessible, HTML title-matching services, not their version, configuration, or authentication status. The exposure risk of such services stems from the authentication settings and the systems it can reach. A compromised Gerrit can lead to source code modification, not just data disclosure.

Proper configuration includes selecting an appropriate authentication method and enforcing strong authentication for administrative accounts. The service should only be reachable from required networks, ideally via an access proxy. However, a single title query does not measure vulnerability, but rather the service's fingerprint. The number reported should be viewed as the population to review, not an incident count.