“About 10% — 474 — still authenticated to GitHub's API as 440 distinct Apps.”
Scale of the exposure and how it was measured
GitGuardian extracted more than 500,000 exposed RSA private keys from its dataset of public leaks and narrowed them to 4,802 keys found in a GitHub context alongside an App ID. Of those, about 10% (474) still authenticated to GitHub's API as 440 distinct Apps, the company reported.
Those figures matter because GitHub App private keys never expire: they "stay valid until someone manually deletes them," and anyone holding one can request access tokens indistinguishable from the App's own, GitGuardian said. That permanence turns a single public leak into a potentially long-lived access vector.
What the leaked keys could reach inside organizations
GitGuardian quantified permissions across the affected Apps. Some 72% of the Apps could read private repository content; 207 could write to private repositories. Another 44 Apps had organization administration privileges, 40 could administer self-hosted runners and 98 could control workflows.
GitGuardian warned these privileges could allow "a complete takeover of an organization or code execution on its internal infrastructure." Most of the exposed Apps were not marketplace products: 59% had a single installation, a pattern consistent with internal automation and one-off tooling that can be forgotten.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildShared tooling and long-lived, unmaintained projects
The widest reach GitGuardian found came from a shared tool: the key for Access Tokens for GitHub Actions, installed on about 300 organizations including Civica and Sierra Nevada Corp. That key leaked in January 2024 and had rights to modify repository content and administer organizations. Its maintainer rotated the key after GitGuardian's disclosure.
Another persistent example was the Crusher.dev test framework: a key leaked in 2020 still works "even though the project has been unmaintained for three years," GitGuardian said. That pattern — keys tied to shared or unmaintained tooling — explains why some exposures remain active for years.
CDC and BuildBuddy: concrete incidents and reactions
GitGuardian identified a private App key owned by an organization named cdcent that leaked in April 2025 in a repository belonging to CDCGov, the official GitHub organization of the US Centers for Disease Control and Prevention. The App had write access to two private repositories, one of which appears to mediate between CDC repositories and its Azure infrastructure. GitGuardian said the key could potentially have enabled arbitrary code execution in the CDC's Azure tenant, though it "did not interact with the repository." The company reported the leak through the HHS disclosure portal on September 4 and the credentials were revoked on September 18.
Separately, a key for BuildBuddy's internal development App leaked in June 2025 with rights to write to and administer the company's main repository, potentially exposing its CLI users, self-hosted servers and SaaS platform. BuildBuddy took the App down and "found no sign of malicious use," GitGuardian reported.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: the persistence of non-expiring App private keys means rotation and continuous monitoring matter. GitGuardian advised rotating any App key that may have leaked and "monitoring for exposure continuously rather than once at setup."
- Policymakers and regulators: incidents tied to a federal GitHub organization and a disclosure through the HHS portal underline that public sector code repositories can surface credentials with downstream cloud implications — including, GitGuardian said, potential arbitrary code execution in an Azure tenant.
- Affected enterprises and procurement leaders: most exposed Apps were internal or single-installation tools. That points to governance gaps in how internal automation and one-off tooling are created, maintained and decommissioned.
GitGuardian's findings draw a straight line from accidental public leaks to persistent, high-impact access. The combination of leaked RSA private keys, non-expiring GitHub App credentials, and scripts or services installed across hundreds of organizations produced exposures that, in some cases, lasted years. The company’s advice is correspondingly simple and specific: rotate any App key that may have leaked and keep watching for new exposures rather than assuming one cleanup is enough.
Original report: Infosecurity Magazine — Hundreds of Leaked GitHub App Keys Still Authenticate
