Hundreds of Leaked GitHub App Keys Still Authenticate
GitGuardian found 474 leaked GitHub App private keys still authenticate, some with organization admin rights.
GitGuardian tested 4,802 exposed RSA private keys paired with GitHub App IDs and found 474, about 10 percent, still authenticated as 440 distinct Apps. GitHub App private keys do not expire until they are manually deleted, and a holder can mint access tokens indistinguishable from the App. About 72 percent could read private repositories, 207 could write, 44 had organization administration rights, and one Actions token App covered roughly 300 organizations. A CDC App key leaked in a CDCGov repository was revoked on September 18 after disclosure; BuildBuddy and the Actions maintainer also rotated keys and reported no malicious use.
- 474 of 4,802 GitHub-context keys still authenticated as 440 Apps.
- 44 Apps had organization admin rights; 207 could write repository content.
- A shared GitHub Actions token App was installed on about 300 organizations.
- CDC App key, leaked April 2025, was revoked on September 18, 2025.
- A 2020 Crusher.dev key still works on an unmaintained project.
- ATT&CK
- T1552.001 Unsecured Credentials: Credentials In FilesT1552.004 Unsecured Credentials: Private KeysT1078 Valid Accounts
- Vendors
- GitHub
- Products
- GitHub AppsGitHub Actions
- Organizations
- GitGuardianGitHubCenters for Disease Control and PreventionBuildBuddyCivicaSierra Nevada Corporation
- Countries
- United States
From the original article
2 min read at infosecurity-magazine.com
GitGuardian finds 474 leaked GitHub App keys still authenticating, including keys with admin access
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.