Exposed GitHub App private keys pose long-term account takeover risk
GitGuardian found 474 still-valid private keys among 4,802 exposed GitHub App credentials, with 72% able to read private repositories and 207 able to write. A leaked key for an app managing GitHub Actions workflows potentially affected 300 organizations. The company notified affected owners and recommends revoking unused keys.
GitGuardian’s scan of 4,802 exposed GitHub App credentials, collected since 2019, revealed 474 still-active private keys. Of those, 72% could read private repositories, and 207 could write to them. The most severe case involved a key for “Access Tokens for GitHub Actions,” leaked in January 2024, which potentially impacted 300 organizations, including Civica and Sierra Nevada Corp. Other exposed apps belonged to BuildBuddy, Crusher.dev, and a private CDC-linked application. Notably, 156 leaked keys appeared in unrelated repositories, complicating attribution, while 59% of affected apps had only a single installation—often forgotten internal tools.
The persistence of valid GitHub App private keys could enable long-term, silent infiltration of software supply chains. Organizations relying on third-party apps face risk not only to their own code but to downstream users if attackers inject malicious changes into CI/CD pipelines. While GitGuardian notified owners, many may lack visibility into forgotten keys, meaning account takeover could occur months after exposure. The impact may ripple across enterprises, government agencies, and open-source projects, eroding trust in automated development workflows.