Title: Significant Security Vulnerability: GitHub App Private Keys Exposed
In a troubling revelation, a recent report from GitGuardian has identified that hundreds of private keys belonging to GitHub Apps have been inadvertently leaked in public code repositories. Alarmingly, these keys remain active, with some potentially granting unauthorized admin access to entire organizations.
According to the research conducted by GitGuardian, it was discovered that over 500,000 exposed RSA private keys had been extracted from a dataset detailing public leaks. This vast pool of data was meticulously narrowed down to 4,802 keys which were specifically found in a GitHub context, paired with their corresponding App IDs. Remarkably, around 10% of these keys, totaling 474, still managed to authenticate with GitHub’s API across 440 distinct Apps.
One of the most concerning aspects of GitHub App private keys is that they do not expire like typical credentials. Once generated, these keys remain valid until manually deleted. This means that anyone in possession of such a key can request access tokens that appear indistinguishable from the App’s own, significantly increasing the risk of unauthorized access.
Potential Impact of the Leaked Keys
The scope of the permissions linked to these leaked keys poses a serious threat. A staggering 72% of the affected Apps possess the capability to read private repository content, while 207 have the authority to write to it. The data further indicates that 44 Apps had organization administration privileges, 40 could oversee self-hosted runners, and 98 were capable of controlling workflows within organizations. These permissions create a pathway to potentially take over an organization or execute code within its internal infrastructure.
Additionally, most of the affected Apps were not marketplace products; 59% of them had a single installation. This statistic suggests that many of these keys were tied to internal automation processes or custom tooling that developers may have overlooked over time.
A particularly noteworthy case involves a shared tool for Access Tokens used for GitHub Actions, which leaked in January 2024. This key was installed across approximately 300 organizations, including high-profile companies like Civica and Sierra Nevada Corp. The permissions associated with this key allowed for modifications to repository content and organizational administration. After GitGuardian’s announcement of the leak, the maintainer opted to rotate the key, highlighting the urgency of addressing such vulnerabilities.
Another troubling instance includes a key tied to the Crusher.dev test framework. Despite the project being unmaintained for three years, the leaked key continues to function. Users who have not uninstalled the App remain at risk of private code theft, demonstrating the long-lasting impact of unaddressed vulnerabilities.
High-Profile Entities Exposed
The implications of these leaks extend to renowned organizations. Notably, a private App key associated with an entity named "cdcent" was leaked in April 2025 within a repository belonging to CDCGov, the official GitHub organization for the U.S. Centers for Disease Control and Prevention (CDC). The App had write access to two private repositories, one of which appeared to facilitate communication between CDC repositories and its Azure infrastructure. GitGuardian cautioned that this key could have allowed for arbitrary code execution within the CDC’s Azure tenant, although it did not interact directly with the repository. The agency proactively reported the leak through the Department of Health and Human Services (HHS) disclosure portal on September 4, but the credentials were not revoked until September 18.
Similarly, in June 2025, a key for BuildBuddy’s internal development App was leaked. This key provided rights to write to and administer the company’s main repository, leading to potential exposure of its CLI users, self-hosted servers, and SaaS platform. After becoming aware of this breach, BuildBuddy took the Application down and reported no evidence of malicious usage.
Recommendations for Mitigation
In light of these serious security lapses, GitGuardian has recommended several proactive measures. It urges organizations to rotate any potentially leaked App keys and advocate for continuous monitoring of their exposure rather than limiting checks to singular set-up instances. By implementing these safeguards, organizations can better protect themselves against similar vulnerabilities in the future.
The ongoing challenges associated with leaking GitHub App private keys underscore the necessity for enhanced vigilance and security protocols within the development community. As these irregularities continue to pose considerable risks, a collective effort towards greater awareness and prevention is essential.