10K Docker images spray live cloud creds across the internet (opens in new tab)

> The exposed secrets aren't theoretical test tokens or placeholders: they include active credentials.

How do security researchers verify this?