GITGUARDIAN researchers found 474 valid GitHub App RSA private keys exposed in public or third-party repositories. The keys belonged to 440 distinct applications and were identified after scanning more than 500,000 public RSA credentials, including 4,802 associated with GitHub integrations. GitHub App keys do not expire automatically, so credentials leaked years ago can remain usable until manually revoked.
The report says 72% of the affected apps had content permissions, 207 could write to repositories, 44 had full organisation administration rights, 40 could control self-hosted runners and 98 could manage automation workflows.
The exposed credentials affected public-sector bodies, open-source projects and commercial organisations. One active key belonging to the US Centers for Disease Control and Prevention was found in a public CDCGov repository and reportedly allowed writing to private repositories linked to Azure environments. Other affected tools included Access Tokens for GitHub Actions, installed across 300 organisations, BuildBuddy and the abandoned Crusher.dev testing platform.
The research indicates potential access to private code, repository modification and workflow or runner abuse; it does not establish that all exposed permissions were used maliciously.
GitGuardian disclosed the findings to the affected parties. Access Tokens for GitHub Actions maintainers rotated their keys, while BuildBuddy removed its exposed application and said there had been no malicious access. Federal authorities were notified on 4 September; the CDC acknowledged the report on 9 September and revoked the key on 18 September.
Organisations should audit installed GitHub Apps, remove obsolete integrations, rotate exposed signing keys, use secret-scanning controls and restrict applications to only the repositories they require.