A month-long scan of 7.25 million Chinese repositories produced 26,400 credentials that still authenticated when tested.