Hundreds of GitHub App private keys leaked in public code still work with some granting admin access to entire organizations, according to research from GitGuardian.
The company extracted more than 500,000 exposed RSA private keys from its dataset of public leaks and narrowed them to 4802 found in a GitHub context alongside an App ID. Of those, about 10% (474) still authenticated to GitHub's API as 440 distinct Apps.
Unlike most credentials, GitHub App private keys never expire. They stay valid until someone manually deletes them, and anyone holding one can request access tokens indistinguishable from the App's own.
What the Leaked Keys Could Reach
Some 72% of the affected Apps could read private repository content, and 207 could write to it. Another 44 had organization administration privileges, 40 could administer self-hosted runners and 98 could control workflows.
GitGuardian said those permissions could allow a complete takeover of an organization or code execution on its internal infrastructure. Most of the Apps were not marketplace products, with 59% having a single installation, which points to internal automation and one-off tooling that is easy to forget.
The widest reach came from a shared tool. The key for Access Tokens for GitHub Actions, installed on about 300 organizations including Civica and Sierra Nevada Corp, leaked in January 2024 with rights to modify repository content and administer organizations.
Its maintainer rotated the key after GitGuardian's disclosure.
A key for the Crusher.dev test framework, leaked in 2020, still works even though the project has been unmaintained for three years, GitGuardian said. Users who never uninstalled the App remain exposed to private code theft.
Read more on exposed credentials: CISA Details Incident Response to Exposed AWS GovCloud Keys
CDC and BuildBuddy Among Those Exposed
A key for a private App owned by an organization named cdcent leaked in April 2025 in a repository belonging to CDCGov, the official GitHub organization of the US Centers for Disease Control and Prevention.
The App had write access to two private repositories, one of which appears to mediate between CDC repositories and its Azure infrastructure.
GitGuardian said the key could potentially have enabled arbitrary code execution in the CDC's Azure tenant, though it did not interact with the repository. It reported the leak through the HHS disclosure portal on September 4 and the credentials were revoked on September 18.
The key for BuildBuddy's internal development App leaked in June 2025, with rights to write to and administer the company's main repository, potentially exposing its CLI users, self-hosted servers and SaaS platform. BuildBuddy took the App down and found no sign of malicious use.
To protect against this and similar threats, GitGuardian advised rotating any App key that may have leaked and monitoring for exposure continuously rather than once at setup.