Do Son 
At a Glance
| Attribute | Details |
|---|---|
| Organization | Multiple entities (including the US CDC, BuildBuddy, and Civica) |
| Data Exposed | GitHub App RSA private keys, repository access, administrative permissions |
| Number Affected | 474 valid keys across 440 distinct Apps; hundreds of organizations exposed |
| Cause | Cryptographic private keys committed into public and third-party repositories |
| Disclosure Status | Responsibly disclosed by GitGuardian; key revocations and takedowns completed |
| Source | GitGuardian research report |
Executive Summary
Security researchers discovered hundreds of active cryptographic secrets openly exposed across public code repositories. Specifically, GitGuardian found 474 valid GitHub App private keys that allow unauthorized access to private corporate codebases. These exposed keys threaten hundreds of organizations because the GitHub platform never expires them automatically.
What Was Exposed
Security vendor GitGuardian scanned more than 500,000 public RSA credentials and identified 4,802 keys tied to GitHub integrations. When researchers tested these credentials, 474 keys still authenticated successfully against GitHub API endpoints. These active credentials belonged to 440 distinct applications.
The exposed secrets grant broad privileges across target accounts. According to the research team, “72% of the compromised Apps had some content permissions, meaning that they could access private repositories of the organizations that use them.” Furthermore, 207 applications held write permissions, allowing unauthorized parties to modify internal code.
Most alarmingly, 44 applications possessed full organization administration rights. Another 40 applications could control self-hosted build runners, while 98 controlled automation workflows. Attackers holding these administrative secrets can modify repository settings, run untrusted scripts, and steal proprietary assets.
How It Happened
GitHub Apps provide automated capabilities for continuous integration, code quality reviews, and project management. Unlike personal accounts, each application operates under its own identity. It signs authentication tokens using a dedicated RSA cryptographic key pair.
Developers generate these keys through the GitHub settings dashboard to sign JSON Web Tokens. However, engineers frequently commit private key files into public source code repositories by mistake. In other cases, developers place secret keys into temporary test repositories and forget about them.
The fundamental architecture of the platform amplifies this operational risk. As GitGuardian emphasized, “App keys have no expiration date. They live until someone manually deletes them from the configuration.” Consequently, a key leaked years ago remains active until an administrator takes manual action. Furthermore, researchers discovered that 156 keys appeared in repositories that the application maintainers did not own. This separation makes discovering leaked GitHub App private keys much more difficult for security tools.
Who Is Affected
The exposure directly impacts public sector agencies, open-source projects, and enterprise software vendors. Most compromised tools were custom internal bots with single installations. However, several high-profile organizations suffered exposure through widely shared integration tools.
Public Health and Government Infrastructure
The investigation uncovered an active key belonging to the United States Centers for Disease Control and Prevention. The secret appeared inside a public repository belonging to the official CDCGov organization. This private key provided write access to private repositories inside the CDCent development group. Documentation revealed that these repositories connect directly to Azure cloud computing environments. Consequently, unauthorized actors could have executed unapproved commands within federal cloud systems.
Commercial Software and Automation Tools
Another incident affected Access Tokens for GitHub Actions, an integration installed across 300 organizations. High-profile enterprise users, including defense contractor Sierra Nevada Corp and software company Civica, faced direct exposure. The application possessed broad permissions to alter repository files and administer user organizations.
Additionally, researchers identified an exposed developer key for BuildBuddy. This tool helps software teams manage complex build pipelines. Because the compromised application held write permissions for core repositories, attackers could have poisoned source code for thousands of downstream users. Finally, an abandoned open-source testing platform named Crusher.dev retained active read permissions years after developers discontinued maintenance.
What Affected People Should Do
Development teams must audit their organizations for unauthorized or obsolete applications immediately. Administrators should review all installed applications under their account settings and revoke unused tools. If your team maintains custom applications, check when you last rotated your signing keys.
Organizations must treat every private key as an enterprise identity credential. Security teams should implement automated secret scanning tools to catch accidental commits before code reaches public branches. Furthermore, administrators should restrict application installations so that tools only access explicitly selected repositories rather than entire organizations.
The Company Response
GitGuardian reported the security findings to all impacted parties through responsible disclosure channels. Maintainers of the Access Tokens for GitHub Actions tool rotated their keys right after notification, securing all 300 client organizations. Similarly, the security team at BuildBuddy removed their exposed development application and confirmed that no malicious access occurred.
Meanwhile, researchers notified federal authorities regarding the exposed healthcare repository on September 4. Federal administrators acknowledged the report on September 9 and revoked the exposed key on September 18. Treating machine identities with strict rotation schedules remains the best defense against supply chain intrusions.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
