99% of repository access tokens never expire
BlueFlag report finds developer and AI agent permissions outlast projects, with 99% of tokens unexpired and non-human identities outnumbering humans 8:1.
BlueFlag Security's State of Developer Risk 2026 report shows 99% of repository access tokens have no expiration date and 84% allow code changes. The average developer unused 61% of permissions, and four in five organizations retained admin rights on inactive accounts over 90 days. Non-human identities outnumber developers eight to one. Organizations using AI coding agents often lack oversight.
- 99% of tokens have no expiration
- Non-human identities 8:1 ratio
- 83% of organizations have unapproved AI tools
- 68% of agent identities hold admin permissions
- Half of organizations saw code cloning spikes
Impact: Prolonged access to repositories after project end
| Product | Affected |
|---|---|
| BlueFlag Security developer tools | — |
- 1.Review and revoke unused permissions
- Organizations
- BlueFlag Security
From the original article
3 min read at helpnetsecurity.com
Developers, automated tools and AI coding agents hold permissions that can outlast the work they were granted for. Without access reviews, organizations can leave accounts able to copy or change company code after the work ends, according to BlueFlag Security’s The State of Developer Risk 2026 report.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.