Loading story…
GitGuardian found 474 publicly exposed GitHub App RSA private keys that still authenticated as 440 distinct apps out of 4,802 GitHub-context keys examined. Because GitHub App private keys can remain valid indefinitely, an attacker with a leaked key can mint API tokens indistinguishable from those issued by the legitimate app and impersonate it.
The valid credentials included keys linked to a shared GitHub Actions token app, CDC-related infrastructure, BuildBuddy, and the unmaintained Crusher.dev framework. Affected apps could retain access to private repositories and permissions to modify code, administer organizations, manage self-hosted runners, or control workflows; organizations should rotate exposed App keys immediately and continuously monitor public sources for credential leaks.
See attribution, scope, and your downstream exposure.
9 events from the most recent confirmed update back to the earliest known activity.
A private key for BuildBuddy's internal development GitHub App leaked. The App had write and administration rights to BuildBuddy's main repository, potentially affecting its CLI users, self-hosted servers, and SaaS platform.
A private key for a private GitHub App owned by cdcent leaked in a CDCGov repository. The App could write to two private CDC repositories, including one apparently mediating between CDC repositories and Azure infrastructure.
A private key for the Access Tokens for GitHub Actions App leaked. The App was installed in roughly 300 organizations, including Civica and Sierra Nevada Corp., and had repository-modification and organization-administration permissions.
A private key for the Crusher.dev test-framework GitHub App leaked. The framework was later reported as unmaintained, leaving organizations that retained its installation exposed to private-code theft.
GitGuardian reported that affected Apps included permissions to read private repositories, write private repository content, administer organizations, manage self-hosted runners, and control workflows. It warned that these permission combinations could enable organization takeover or code execution on internal infrastructure.
GitGuardian analyzed more than 500,000 publicly exposed RSA private keys and identified 4,802 GitHub-context keys associated with App IDs. Of those, 474 still authenticated to GitHub and corresponded to 440 distinct GitHub Apps, allowing impersonation and token minting as the legitimate Apps.
The maintainer of Access Tokens for GitHub Actions rotated its exposed key after GitGuardian's disclosure, and BuildBuddy took down its exposed App and said it found no evidence of malicious use.
The credentials associated with the exposed CDC-related GitHub App key were revoked following GitGuardian's disclosure.
GitGuardian reported the CDC-related exposed credential through the HHS disclosure portal. GitGuardian assessed that the key could potentially enable arbitrary code execution in the CDC Azure tenant, but stated it did not interact with the repository.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
infosecurity-magazine.com
Open sourcereddit.com
Open sourceblog.gitguardian.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The widely used GitHub Action **`tj-actions/changed-files`** was compromised after an attacker gained write access to the repository and retargeted release tags to a malicious orphaned commit, causing workflows pinned to tags rather than immutable SHAs to run attacker-controlled code. The backdoor downloaded and executed a remote payload that scraped decrypted GitHub Actions secrets from process memory and printed them into workflow logs, exposing repositories that executed the action and creating acute risk for public projects where logs were openly accessible. The incident was detected after anomalous outbound network activity was observed, and the maintainer removed the malicious changes soon afterward. Follow-on analysis found the blast radius was substantial because the action was referenced across roughly **23,000 repositories** and many workflows were not pinned to a full commit hash. GitGuardian reported that among workflows executed during the compromise window, hundreds showed signs of exploitation and **603 secrets** were exposed in logs, including temporary GitHub tokens, DockerHub credentials, AWS keys, GitHub personal access tokens, Jira tokens, and cloud.gov credentials. Organizations using the action were urged to review workflow runs from March 14 onward, delete affected logs, rotate any exposed credentials, audit dependencies and commits, and pin third-party GitHub Actions to full commit SHAs to reduce future supply-chain risk.
Jun 29, 2026
Researchers from Stanford University, the University of California, Davis, and TU Delft found **1,748 valid API credentials** exposed across roughly **10,000 public webpages** after analyzing about **10 million websites**, revealing a broad secret-leakage problem outside traditional code repositories. The credentials, identified with TruffleHog and detailed in the study *Keys on Doormats: Exposed API Credentials on the Web*, provided access to services including **AWS**, **GitHub**, **Stripe**, and **OpenAI**. The exposed secrets were tied to multinational corporations, critical infrastructure operators, government agencies, and at least one global bank. Most of the exposed credentials were embedded in **JavaScript** resources, often inside bundled files generated by tools such as Webpack, creating direct paths into cloud infrastructure, payment systems, and software repositories. Researchers said AWS keys made up more than **16%** of verified exposures, and cited cases including cloud credentials linked to a global bank’s core infrastructure and firmware repository credentials associated with drones and remote-controlled devices, raising the risk of malicious firmware updates. After responsible disclosure, the number of exposed credentials dropped by about half within two weeks, but the study found such secrets often remain publicly accessible for an average of **12 months** and sometimes for years.
Jun 29, 2026
Datadog Security Research reported sustained campaigns abusing GitHub’s public and authenticated APIs to enumerate enterprise organizations, repositories, and users while blending into normal developer traffic. The activity relied on automated scraping through endpoints including `/graphql`, dormant “ghost” GitHub accounts, and in some cases compromised OAuth tokens or personal access tokens. Researchers identified more than 50 ghost accounts since October 2025, along with recurring user agents such as `GitHub-Company-Scraper`, `GitHub-Scraper-Tool/1.0`, `GitHubAnalytics/1.5`, `GitHub-Commit-Fetcher/1.3`, `GitHub-Commit-Fetcher/1.4`, and `GitHub-Event-Fetcher/2.2`, with some infrastructure linked to 3xK Tech. While much of the traffic queried public data and appeared benign in isolation, researchers said the aggregate behavior amounted to coordinated reconnaissance that could support later theft of secrets, repository cloning, or broader intrusion activity. In a more serious observed case, a tool identified as `repo-dumper` successfully cloned or accessed a private repository, with GitHub audit logs showing `git.clone` and `api.request` events against private paths. Defenders were urged to baseline GitHub audit activity and hunt for unusual user agents, actor names, token types, source ASNs, and successful access to private resources, while also enforcing MFA, conducting access reviews, enabling audit log streaming, and using repository secret scanning.
Jul 11, 2026