GitGuardian Finds 474 Valid GitHub App Keys, Exposing Up to 300 Organizations to Takeover
Updated
Updated · InfoWorld · Sep 23
GitGuardian Finds 474 Valid GitHub App Keys, Exposing Up to 300 Organizations to Takeover
2 articles · Updated · InfoWorld · Sep 23
Summary
474 GitHub App private keys were still valid among 4,802 publicly exposed since 2019, letting attackers keep minting fresh access tokens until owners manually revoke the keys.
72% of the compromised apps could read private repositories, 207 could write to them, 44 had organization-admin rights, and 40 could administer self-hosted runners—enough in some cases to add owners, lock out admins, or run code internally.
One leaked key for the “Access Tokens for GitHub Actions” app was tied to an app installed at 300 organizations, while other exposed keys involved BuildBuddy, Crusher.dev and a private CDC-linked app.
156 leaked keys appeared in unrelated repositories, obscuring ownership and widening the blast radius beyond app developers to every organization that installed the app and potentially downstream software users.
GitGuardian said GitHub App keys do not expire automatically despite short-lived JWTs and installation tokens, making regular key rotation or revocation the only effective defense.