Leaked GitHub app keys retain live access

Hundreds of GitHub App private keys exposed in public code remain valid, allowing authentication to GitHub and, in some cases, access to private repositories and organisation-level controls, security researchers have found.

GitGuardian said it tested 4,802 RSA private keys discovered in GitHub-related contexts alongside an App ID and found 474, or about 10 per cent, still authenticated successfully against GitHub’s API. Those keys represented 440 distinct GitHub Apps, underscoring the persistence of credentials that remain usable until manually revoked.

The findings, published on September 22, followed an analysis of more than 500,000 exposed RSA private keys collected in GitGuardian’s dataset of publicly leaked secrets. Researchers narrowed the pool to keys associated with GitHub Apps, then signed JSON Web Tokens and queried GitHub’s /app API endpoint to establish whether each credential was still valid.

The permissions attached to the affected Apps varied sharply. GitGuardian said 72 per cent had some level of repository-content access, while 207 could write to repository contents. Forty-four Apps carried organisation administration privileges, 40 could administer self-hosted runners and 98 could control workflows. Depending on installation scope, such rights could allow changes to private code, workflow execution or broader control within an organisation.

GitHub’s own documentation confirms that App private keys do not expire automatically and must be manually revoked. The company recommends using multiple keys to permit rotation without downtime and advises storing them in dedicated key vaults where possible. It also warns developers not to hard-code private keys, even inside private repositories, because anyone obtaining a key can authenticate as the App.

GitHub Apps use private keys to sign short-lived JSON Web Tokens, which identify the application to GitHub. Once GitHub verifies the signed token, the App can request an installation access token carrying the permissions granted when the App was installed. The installation token expires, but the underlying private key can continue generating fresh authentication material until it is deleted.

The research highlights a distinction between the short life of access tokens and the indefinite life of the signing credential behind them. Revoking or rotating the private key is therefore essential after exposure, because token expiry alone does not remove access.

GitGuardian said installations among the 440 affected Apps ranged from none to more than 300. Fifty-nine per cent had only one installation, indicating that many were likely internal tools, development integrations or narrowly deployed automation rather than widely distributed marketplace applications.

Researchers also found that 156 leaked App keys appeared in repositories not owned by the application maintainer, complicating identification and remediation. Such exposures can arise when credentials are copied into unrelated projects, test code, examples or automated workflows and then remain in version history after the original purpose has disappeared.

Several cases showed the potential reach. A private key for an App used to create access tokens for GitHub Actions had been exposed in a January 2024 commit and was installed across about 300 organisations. GitGuardian said the maintainer rotated the key after disclosure, closing that access path.

A development App associated with BuildBuddy was also found with permissions to write to and administer target repositories, including the project’s principal source-code repository. GitGuardian said BuildBuddy removed the application after being notified and found no evidence of malicious exploitation.

Another exposed key belonged to an App connected to the US Centers for Disease Control and Prevention. GitGuardian said the key, leaked in April 2025, provided write access to two private repositories in an organisation named cdcent. The researchers did not interact with the repositories but said public documentation indicated one mediated activity involving CDC systems and Azure infrastructure.

GitGuardian disclosed the CDC-related issue through the US Department of Health and Human Services responsible-disclosure channel on September 4. It said acknowledgement arrived on September 9 and the credential was revoked on September 18.