Study Finds Hundreds of Leaked GitHub App Keys Still Work, Some With Admin Access

New research from security firm GitGuardian has revealed that hundreds of GitHub App private keys leaked in public code repositories are still valid and usable. From a dataset of over 500,000 exposed RSA private keys, researchers identified 4,802 linked to GitHub Apps, and found that 474 of these, tied to 440 distinct Apps, could still authenticate successfully with GitHub's API.

The risk is significant because GitHub App private keys do not expire automatically. They remain valid indefinitely unless manually deleted, meaning anyone who obtains a leaked key can generate access tokens that look identical to the App's legitimate ones. GitGuardian found that 72% of the affected Apps could read private repository content, 207 could write to it, and dozens held organisation administration or workflow control rights, permissions that could allow full takeover of a company's code and infrastructure.

Many of the exposed Apps appeared to be internal tools rather than marketplace products, often forgotten after single use. Notable cases included a widely used GitHub Actions tool installed across roughly 300 organisations, an unmaintained testing framework still exposing user data years later, and a key belonging to the US Centers for Disease Control and Prevention's GitHub organisation, which was reported and revoked in September 2025.