# Code Security, Identity and Access Management, Security

Published articles for Code Security, Identity and Access Management, Security.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## GitHub App keys can still enable takeovers long after they are forgotten

DevFeed: [GitHub App keys can still enable takeovers long after they are forgotten](<https://devfeed.tech/articles/github-app-keys-can-still-enable-takeovers-long-after-they-are-forgotten-58527.md>)

Original publisher: [Read original article](<https://www.infoworld.com/article/4225630/github-app-keys-can-still-enable-takeovers-long-after-they-are-forgotten.html>)

Author: Shweta Sharma

Published: 2026-09-23T15:10:48Z

Content type: news

Language: en

Sources: [InfoWorld](<https://devfeed.tech/sources/infoworld.md>)

Topics: [GitHub](<https://devfeed.tech/topics/github.md>), [Security](<https://devfeed.tech/topics/security.md>), [private key](<https://devfeed.tech/topics/private-key.md>), [GitGuardian](<https://devfeed.tech/topics/gitguardian.md>), [Secret Scanning](<https://devfeed.tech/topics/secret-scanning.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [Repository](<https://devfeed.tech/topics/repository.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Self-hosted](<https://devfeed.tech/topics/self-hosted.md>)

Tags: [code-security](<https://devfeed.tech/tags/code-security.md>), [code-security-identity-and-access-management-security](<https://devfeed.tech/tags/code-security-identity-and-access-management-security.md>), [gitguardian](<https://devfeed.tech/tags/gitguardian.md>), [github](<https://devfeed.tech/tags/github.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [identity-and-access-management](<https://devfeed.tech/tags/identity-and-access-management.md>), [permissions](<https://devfeed.tech/tags/permissions.md>), [private-key](<https://devfeed.tech/tags/private-key.md>), [repositories](<https://devfeed.tech/tags/repositories.md>), [secret-scanning](<https://devfeed.tech/tags/secret-scanning.md>), [security](<https://devfeed.tech/tags/security.md>), [self-hosted](<https://devfeed.tech/tags/self-hosted.md>)

### AI overview

The article reports that leaked GitHub App private keys can remain valid for years and may enable unauthorized access to repositories, workflows, self-hosted runners, and organization administration. It describes findings from GitGuardian and explains how attackers could use valid keys to inject malicious code or compromise production environments.

### Source excerpt

GitHub allows organizations to install GitHub Apps that automate and extend certain functionality on the platform and have access to selected repositories and permissions. But the private keys these applications use to authenticate themselves can remain valid for years unless manually revoked. If leaked, those keys can potentially give attackers administrative control over an organization's GitHub account, says GitGuardian, which found 474 still-valid GitHub App private keys among 4802 publicly exposed ones it has collected since 2019. In testing the keys for validity, it was also able to determine what access rights they provided, finding that "72% of the compromised Apps could read private repository content, and 207 could write to it, turning one leaked key into an organization takeover," GitGuardian researcher Gaetan Ferry said in a blog post. Among the GitHub Apps affected by the leaked keys was "Access Tokens for GitHub Actions," an application used to manage access for GitHub Actions workflows. Its private key was exposed in January 2024 after being accidentally committed to a repository, potentially affecting 300 organizations where the app was installed, including Civica and Sierra Nevada Corp. BuildBuddy, Crusher.dev, and a private application associated with the US Centers for Disease Control and Prevention were among the other GitHub Apps for which GitGuardian found exposed keys. Agnidipta Sarkar, chief evangelist at security software vendor ColorTokens, said the initial abuse is "trivially straightforward" and an attacker can achieve that with a valid private key and the corresponding App ID. For maximum impact, he said, attackers could chain the abuse by "injecting malicious code into the repository and when the code is built or deployed, it can compromise downstream users or production environments." An attacker might also be able to modify CI/CD runner configurations to execute arbitrary code on the organization's internal network infrastructure, Sar