474 Leaked GitHub App Keys Still Authenticate, Some With Admin Access

September 23, 2026 at 08:00 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

GitGuardian found 474 leaked GitHub App private keys still authenticate, including 44 with organization admin rights. Some keys exposed private code at the CDC and BuildBuddy. The CDC key was revoked September 18 after disclosure on September 4.

Key Facts

GitGuardian extracted over 500,000 exposed RSA private keys and identified 4,802 in a GitHub context with an App ID.
About 10% of those keys, 474, still authenticated to GitHub's API as 440 distinct Apps.
72% of the affected Apps could read private repository content, and 207 could write to it.
44 Apps had organization administration privileges, 40 could administer self-hosted runners, and 98 could control workflows.
A key for the CDC's private App leaked in April 2025 and was revoked on September 18, 2025.

Scale of Exposure

GitGuardian extracted more than 500,000 exposed RSA private keys from its dataset of public leaks. It narrowed them to 4,802 keys found in a GitHub context alongside an App ID. About 10% of those, 474 keys, still authenticated to GitHub's API as 440 distinct Apps. Unlike most credentials, GitHub App private keys never expire and remain valid until manually deleted.

Access and Permissions

Some 72% of the affected Apps could read private repository content, and 207 could write to it. Another 44 had organization administration privileges, 40 could administer self-hosted runners, and 98 could control workflows. GitGuardian said those permissions could allow a complete takeover of an organization or code execution on its internal infrastructure. Most of the Apps were not marketplace products, with 59% having a single installation, pointing to internal automation and one-off tooling.

Notable Exposed Organizations

A key for a private App owned by an organization named cdcent leaked in April 2025 in a repository belonging to CDCGov, the official GitHub organization of the US Centers for Disease Control and Prevention. The App had write access to two private repositories, one of which appears to mediate between CDC repositories and its Azure infrastructure. GitGuardian said the key could potentially have enabled arbitrary code execution in the CDC's Azure tenant, though it did not interact with the repository. It reported the leak through the HHS disclosure portal on September 4 and the credentials were revoked on September 18. The key for BuildBuddy's internal development App leaked in June 2025, with rights to write to and administer the company's main repository.