Hundreds of Leaked GitHub App Keys Remain Active, Posing Significant Security Risks
Research reveals hundreds of previously leaked GitHub App private keys are still active, with some granting administrative privileges, enabling potential organization takeovers and code execution.
Hundreds of GitHub App private keys that were previously leaked in public code repositories are still actively authenticating to GitHub, according to new research from GitGuardian. The security firm identified 474 such keys that remain functional, with a significant portion granting elevated permissions, including administrative control over entire organizations and the ability to write to private repositories.
Unlike many other forms of credentials, GitHub App private keys do not expire automatically. They remain valid indefinitely until they are manually revoked by the user or organization. This persistent validity means that any actor who obtained a leaked key can continue to use it to request access tokens that are indistinguishable from legitimate ones, effectively impersonating the legitimate application.
The potential impact of these active, compromised keys is substantial. GitGuardian's analysis found that 72% of the affected applications could read private repository content, and 207 could write to it. More alarmingly, 44 keys granted organization administration privileges, 40 could manage self-hosted runners, and 98 could control GitHub Actions workflows. These permissions could theoretically enable a complete takeover of an organization's code base, infrastructure, or internal systems.
Many of the compromised applications were not public marketplace products but rather internal tools or one-off automation scripts. This suggests that organizations may be neglecting the security of credentials associated with less visible, internally developed tools. For instance, a key for an app named 'Access Tokens for GitHub Actions,' installed on approximately 300 organizations including Civica and Sierra Nevada Corp, was leaked in January 2024. This key possessed rights to modify repository content and administer organizations, though its maintainer has since rotated it.
Further highlighting the long-term risk, a key for the Crusher.dev test framework, leaked in 2020, was still active even though the project has been unmaintained for three years. This indicates that users who never uninstalled the associated application remain vulnerable to potential data theft or unauthorized access to their repositories.
The research also uncovered specific instances involving prominent organizations. A key for a private app owned by an organization named 'cdcent' was leaked in April 2025 within a repository belonging to the US Centers for Disease Control and Prevention (CDC). This app had write access to two private repositories and could have potentially enabled arbitrary code execution in the CDC's Azure tenant. While the credentials were eventually revoked after disclosure, the incident underscores the persistent threat.
In response to these findings, GitGuardian advises organizations to proactively rotate any GitHub App keys that may have been previously exposed. Furthermore, they recommend implementing continuous monitoring for credential exposure rather than relying solely on initial setup security checks. This proactive approach is crucial for mitigating the risks associated with forgotten or overlooked leaked credentials.