GitHub App keys can still enable takeovers long after they are forgotten

GitHub allows organizations to install GitHub Apps that automate and extend certain functionality on the platform and have access to selected repositories and permissions. But the private keys these applications use to authenticate themselves can remain valid for years unless manually revoked.

If leaked, those keys can potentially give attackers administrative control over an organization’s GitHub account, says GitGuardian, which found 474 still-valid GitHub App private keys among 4802 publicly exposed ones it has collected since 2019.

In testing the keys for validity, it was also able to determine what access rights they provided, finding that “72% of the compromised Apps could read private repository content, and 207 could write to it, turning one leaked key into an organization takeover,” GitGuardian researcher Gaetan Ferry said in a blog post.