GitGuardian Finds 474 Active GitHub App Private Keys Exposed in Repositories

Summary

GitGuardian found 474 active GitHub App private keys across 440 apps in public and third-party repositories. The keys could grant access to private repositories and administrative functions; affected organizations were notified and some keys were revoked or rotated.

Key points

Researchers tested 4,802 GitHub-related keys and found 474 still authenticated against GitHub API endpoints.
The active keys belonged to 440 apps; 72% of the apps had content permissions, and 207 could write to repositories.
Researchers found 44 apps with organization administration rights, 40 with control over self-hosted build runners, and 98 with workflow control.
Exposed keys included one associated with the CDC, with write access to private repositories connected to Azure environments.
The article says GitHub App keys do not expire automatically and remain active until manually revoked.
GitGuardian reported the findings to affected parties; the Access Tokens for GitHub Actions keys were rotated, BuildBuddy removed its exposed app, and federal administrators revoked the CDC-related key.

Article Details

Event Type: Exposure of active GitHub App RSA private keys committed to public and third-party repositories, potentially enabling unauthorized access to private repositories and administrative capabilities.
Impact: GitGuardian identified 474 valid keys across 440 applications. Reported permissions included private-repository access for 72% of the affected applications, write access for 207, organization administration rights for 44, control of self-hosted build runners for 40, and control of automation workflows for 98. Exposures involved the US CDC, BuildBuddy, and Civica, among others. The article reports that affected maintainers rotated or revoked keys and that BuildBuddy confirmed no malicious access occurred.