Hundreds of Leaked GitHub App Keys Still Authenticate
GitGuardian found 474 leaked GitHub App private keys still authenticate, some with organization admin rights.
GitGuardian tested 4,802 exposed RSA private keys paired with GitHub App IDs and found 474, about 10 percent, still authenticated as 440 distinct Apps. GitHub App private keys do not expire until they are manually deleted, and a holder can mint access tokens indistinguishable from the App. About 72 percent could read private repositories, 207 could write, 44 had organization administration rights, and one Actions token App covered roughly 300 organizations. A CDC App key leaked in a CDCGov repository was revoked on September 18 after disclosure; BuildBuddy and the Actions maintainer also rotated keys and reported no malicious use.
- 474 of 4,802 GitHub-context keys still authenticated as 440 Apps.
- 44 Apps had organization admin rights; 207 could write repository content.
- A shared GitHub Actions token App was installed on about 300 organizations.
- CDC App key, leaked April 2025, was revoked on September 18, 2025.
- A 2020 Crusher.dev key still works on an unmaintained project.
Full article460 words · extracted from infosecurity-magazine.com · click to collapse
Hundreds of GitHub App private keys leaked in public code still work with some granting admin access to entire organizations, according to research from GitGuardian.
The company extracted more than 500,000 exposed RSA private keys from its dataset of public leaks and narrowed them to 4802 found in a GitHub context alongside an App ID. Of those, about 10% (474) still authenticated to GitHub's API as 440 distinct Apps.
Unlike most credentials, GitHub App private keys never expire. They stay valid until someone manually deletes them, and anyone holding one can request access tokens indistinguishable from the App's own.
What the Leaked Keys Could Reach
Some 72% of the affected Apps could read private repository content, and 207 could write to it. Another 44 had organization administration privileges, 40 could administer self-hosted runners and 98 could control workflows.
GitGuardian said those permissions could allow a complete takeover of an organization or code execution on its internal infrastructure. Most of the Apps were not marketplace products, with 59% having a single installation, which points to internal automation and one-off tooling that is easy to forget.
The widest reach came from a shared tool. The key for Access Tokens for GitHub Actions, installed on about 300 organizations including Civica and Sierra Nevada Corp, leaked in January 2024 with rights to modify repository content and administer organizations.
Its maintainer rotated the key after GitGuardian's disclosure.
A key for the Crusher.dev test framework, leaked in 2020, still works even though the project has been unmaintained for three years, GitGuardian said. Users who never uninstalled the App remain exposed to private code theft.
Read more on exposed credentials: CISA Details Incident Response to Exposed AWS GovCloud Keys
CDC and BuildBuddy Among Those Exposed
A key for a private App owned by an organization named cdcent leaked in April 2025 in a repository belonging to CDCGov, the official GitHub organization of the US Centers for Disease Control and Prevention.
The App had write access to two private repositories, one of which appears to mediate between CDC repositories and its Azure infrastructure.
GitGuardian said the key could potentially have enabled arbitrary code execution in the CDC's Azure tenant, though it did not interact with the repository. It reported the leak through the HHS disclosure portal on September 4 and the credentials were revoked on September 18.
The key for BuildBuddy's internal development App leaked in June 2025, with rights to write to and administer the company's main repository, potentially exposing its CLI users, self-hosted servers and SaaS platform. BuildBuddy took the App down and found no sign of malicious use.
To protect against this and similar threats, GitGuardian advised rotating any App key that may have leaked and monitoring for exposure continuously rather than once at setup.