--- title: GitHub App keys can still enable takeovers long after... description: GitGuardian found 474 still-valid GitHub App private keys among 4,802 publicly exposed credentials collected since 2019. These keys never expire unless... canonical: https://daily.dev/posts/github-app-keys-can-still-enable-takeovers-long-after-they-are-forgotten-gapgkbs9h twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GitHub App keys can still enable takeovers long after they are forgotten | daily.dev og:description: GitGuardian found 474 still-valid GitHub App private keys among 4,802 publicly exposed credentials collected since 2019. These keys never expire unless... og:url: https://daily.dev/posts/github-app-keys-can-still-enable-takeovers-long-after-they-are-forgotten-gapgkbs9h og:image: https://api.daily.dev/og/posts/gapGkBS9H.png og:image:alt: GitHub App keys can still enable takeovers long after they are forgotten og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GitHub App keys can still enable takeovers long after they are forgotten **[InfoWorld](https://daily.dev/sources/infoworld)** · 5 min read · 0 upvotes · 0 comments ## Summary GitGuardian found 474 still-valid GitHub App private keys among 4,802 publicly exposed credentials collected since 2019. These keys never expire unless manually revoked, and 72% of the compromised Apps could read private repository content while 207 could write to it, enabling full organization takeover. Affected apps included an Actions-related tool exposed in January 2024 that potentially impacted 300 organizations, plus BuildBuddy, Crusher.dev, and a CDC-linked application. Because the private key can generate unlimited short-lived JWTs and installation tokens, an attacker who obtains it retains access indefinitely, and researchers stress that manual key rotation is the only real mitigation since GitHub does not expire these keys automatically. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why are leaked GitHub App private keys so dangerous even if the tokens they generate are short-lived? Because the private key itself never expires unless manually revoked, so anyone holding it can keep generating fresh JSON Web Tokens and installation access tokens indefinitely. GitGuardian found 474 still-valid exposed GitHub App private keys, with 72% able to read private repository content and 207 able to write to it, enabling full organization takeover. _Track secret-scanning and supply-chain security research like this on daily.dev to keep CI/CD credentials locked down._ ### How many organizations were affected by the leaked GitHub App key for Access Tokens for GitHub Actions? The private key for the 'Access Tokens for GitHub Actions' app was accidentally committed to a repository in January 2024, potentially affecting around 300 organizations where it was installed, including Civica and Sierra Nevada Corp. GitGuardian's broader scan found 4,802 exposed GitHub App keys total, 474 of which remained valid. _Developers auditing GitHub Actions exposure can follow incident details like this via daily.dev._ ### What permissions can a compromised GitHub App private key grant an attacker? Depending on the app's configuration, a leaked private key can grant read or write access to private repositories, control over self-hosted runners and workflows, or full organization-administration rights. GitGuardian found 40 affected apps could administer self-hosted runners, 98 could control workflows, and 44 had organization-admin privileges, letting an attacker add themselves as owner and lock out legitimate admins. _Security teams weighing GitHub App permission scopes can stay current on findings like this through daily.dev._ ## Similar posts on daily.dev - [2,622 Valid Certificates Exposed: A Google-GitGuardian Study Maps Private Key Leaks to Real-World Risk](https://daily.dev/posts/2-622-valid-certificates-exposed-a-google-gitguardian-study-maps-private-key-leaks-to-real-world-ri-wz0rklumw) · GitGuardian · 0 upvotes · 0 comments - [2,622 Valid Certificates Exposed: A Google-GitGuardian Study Maps Private Key Leaks to Real-World Risk](https://daily.dev/posts/2-622-valid-certificates-exposed-a-google-gitguardian-study-maps-private-key-leaks-to-real-world-ri-wq5uyjxki) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#github](https://daily.dev/tags/github), [#cicd](https://daily.dev/tags/cicd), [#authentication](https://daily.dev/tags/authentication), [#secrets-management](https://daily.dev/tags/secrets-management) [View this post on daily.dev](https://daily.dev/posts/github-app-keys-can-still-enable-takeovers-long-after-they-are-forgotten-gapgkbs9h) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GitHub App keys can still enable takeovers long after they are forgotten","url":"https://daily.dev/posts/github-app-keys-can-still-enable-takeovers-long-after-they-are-forgotten-gapgkbs9h","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/github-app-keys-can-still-enable-takeovers-long-after-they-are-forgotten-gapgkbs9h"},"datePublished":"2026-09-23T15:16:07.109Z","dateModified":"2026-09-23T16:43:38.533Z","description":"GitGuardian found 474 still-valid GitHub App private keys among 4,802 publicly exposed credentials collected since 2019. These keys never expire unless...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/704c0645f4c9d0ba6e0b6a96145e1ed3?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/704c0645f4c9d0ba6e0b6a96145e1ed3?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoWorld","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoWorld","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/bf6d68a999064029b0bb09aa6268f1f3","url":"https://daily.dev/sources/infoworld"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/github-app-keys-can-still-enable-takeovers-long-after-they-are-forgotten-gapgkbs9h","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,github,cicd,authentication,secrets-management","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoWorld","item":"https://daily.dev/sources/infoworld"},{"@type":"ListItem","position":3,"name":"GitHub App keys can still enable takeovers long after they are forgotten"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/github-app-keys-can-still-enable-takeovers-long-after-they-are-forgotten-gapgkbs9h#faq","mainEntity":[{"@type":"Question","name":"Why are leaked GitHub App private keys so dangerous even if the tokens they generate are short-lived?","acceptedAnswer":{"@type":"Answer","text":"Because the private key itself never expires unless manually revoked, so anyone holding it can keep generating fresh JSON Web Tokens and installation access tokens indefinitely. GitGuardian found 474 still-valid exposed GitHub App private keys, with 72% able to read private repository content and 207 able to write to it, enabling full organization takeover. Track secret-scanning and supply-chain security research like this on daily.dev to keep CI/CD credentials locked down."}},{"@type":"Question","name":"How many organizations were affected by the leaked GitHub App key for Access Tokens for GitHub Actions?","acceptedAnswer":{"@type":"Answer","text":"The private key for the 'Access Tokens for GitHub Actions' app was accidentally committed to a repository in January 2024, potentially affecting around 300 organizations where it was installed, including Civica and Sierra Nevada Corp. GitGuardian's broader scan found 4,802 exposed GitHub App keys total, 474 of which remained valid. Developers auditing GitHub Actions exposure can follow incident details like this via daily.dev."}},{"@type":"Question","name":"What permissions can a compromised GitHub App private key grant an attacker?","acceptedAnswer":{"@type":"Answer","text":"Depending on the app's configuration, a leaked private key can grant read or write access to private repositories, control over self-hosted runners and workflows, or full organization-administration rights. GitGuardian found 40 affected apps could administer self-hosted runners, 98 could control workflows, and 44 had organization-admin privileges, letting an attacker add themselves as owner and lock out legitimate admins. Security teams weighing GitHub App permission scopes can stay current on findings like this through daily.dev."}}]} ```