Research found hundreds of exposed GitHub App RSA private keys in public code that remain valid, including keys able to read and write private repos and administer organizations.
GitGuardian identified 474 leaked GitHub App private keys that still authenticate, corresponding to 440 distinct Apps.
Practical mitigation: rotate any potentially leaked App keys and implement continuous monitoring for exposures rather than one‑time checks.
Of those, about 10% (474) still authenticated to GitHub's API as 440 distinct Apps. What the Leaked Keys Could Reach Some 72% of the affected Apps could read private repository content, and 207 could write to it. Another 44 had organization administration privileges, 40 could administer self-hosted runners and 98 could control workflows.
Critical Infrastructure Braces for Sweeping New Cyber Reporting Rules News Feature 28 September 2026 4 Deepfakes Are Becoming a Costly Reality for Businesses, Report Warns News 28 September 2026 5 Citrix Patches Critical Zero Days Under Active Exploitation News 28 September 2026 6 Who Authorized That Agent? Webinar 15:00 — 16:00, 3 September 2026 3 Human Risk in Cybersecurity: Opinion 3 July 2026 3 Google Cloud's New CISO Chris Betz on Integrating AI in Cyber Defenses Interview 7 July 2026 4 How World Cup Password Trends Can Increase Active Directory Risk Blog 23 June 2026 5 New CISA Guide Helps Agencies Adopt SASE For Zero Trust News 25 June 2026 6
Hundreds of Leaked GitHub App Keys Still Authenticate. Unlike most credentials, GitHub App private keys never expire. Its maintainer rotated the key after GitGuardian's disclosure.
Security researchers have uncovered a GitLab behavior that could let attackers use a leaked project email address to push code, trigger CI/CD jobs and reach other repositories accessible to the address owner. Aikido Security researcher Joe Leon detailed the attack path this week in a blog post after reporting it to Git
GitHub Enterprise Cloud now lets organizations export a full inventory of credentials, helping security teams identify stale, overprivileged and forgotten access across users, apps and automation.
1,033 Live Stripe Secret Keys Leaked: How Exposed .env Files Became a Payment Rail Breach On August 18, 2026, a threat actor dumped 1,033 live Stripe sk_live_... keys from 669 vendors on an illicit forum — with a direct claim to Hudson Rock that ~20,000 keys are held for staggered release. The leaked keys had charge ca
Private GitLab email addresses that allow developers to push issues or tasks to a project are being deliberately exposed in READMEs, contributing guides, and support pages used to collect bug reports. [...]
Researcher believes overprivileged Iterable creds exposed 8.8M customer records – and could have enabled mass deletion
An attacker copied about 170 of CrowdSec's private GitHub repositories on May 22 using the account of an employee who had just left, CrowdSec said on September 18. The French security company had kept his GitHub access open. CrowdSec says his laptop was compromised in May's supply chain attack on TanStack, in which mal
Loading more related stories...
Open the app view to save this story, compare related coverage, and continue from the same source.