Report: 99% of Repository Access Tokens Never Expire, Posing Major Security Risks
A new report from BlueFlag Security highlights a critical security gap: 99% of repository access tokens lack expiration dates, leaving code repositories vulnerable to prolonged unauthorized access.
A comprehensive report by BlueFlag Security, titled 'The State of Developer Risk 2026,' reveals a staggering security oversight within organizations: 99% of repository access tokens never expire. This widespread issue means that permissions granted to developers, automated tools, and increasingly, AI coding agents, can persist long after their intended use, creating significant vulnerabilities.
The report indicates that organizations are failing to conduct adequate access reviews, leaving their code repositories exposed to potential unauthorized modifications or data exfiltration. The average developer was found to have not utilized 61% of their granted permissions. Alarmingly, among those with the most unused permissions, 88% had access to business-critical repositories, including those supporting production services, payment systems, and regulated workloads. Furthermore, four out of five organizations had inactive developer identities, some dormant for over 90 days, that still retained administrator privileges, presenting a prime target for credential theft.
Non-human identities, such as service accounts, bots, and access tokens, significantly outnumber human developers in accessing code repositories, with a ratio of eight to one. Of the repository access tokens analyzed, a vast majority—99%—lacked any expiration date. A substantial 84% of these tokens allowed for code changes, and 47% had been inactive for over 90 days without revocation. These persistent credentials can remain active even after a project concludes or an integration is decommissioned, posing a continuous risk.
The proliferation of AI coding tools adds another layer of complexity and risk. Organizations are typically using around seven AI coding tools, with some deploying over thirty. The report found that unapproved AI agents were present in 83% of surveyed organizations, highlighting a lack of oversight in tool adoption. These AI agents, whether operating under a developer's identity or as autonomous agents, inherit or possess extensive permissions.
Autonomous AI agents, in particular, can write, review, and merge code without direct human approval for each action. The report notes that 68% of developer and service account identities used by these agents held administrator permissions, and 81% lacked behavioral monitoring. In a concerning finding, agents in six out of ten organizations with AI activity possessed tokens capable of cloning every repository within the environment.
Distinguishing between human and AI activity is becoming increasingly difficult, as actions taken through a developer's account may be logged under that individual's name without specific commit tags or metadata. This ambiguity complicates security investigations and incident response efforts.
The report also sheds light on other concerning practices, such as unprotected main branches in four out of ten repositories and administrators frequently bypassing code review processes. In 56% of organizations, code was merged despite failed checks, and in two-thirds, it was merged with unresolved reviewer comments. Additionally, private repositories were inadvertently made public in 28% of organizations, potentially exposing sensitive code, documentation, and stored credentials.
These findings underscore a critical need for organizations to implement robust access management policies, including mandatory token expiration, regular access reviews, and enhanced monitoring for both human and non-human identities, especially in the rapidly evolving landscape of AI-assisted development.