GitHub App Keys Never Expire (Bad)
Read the Portuguese translation →
Author: Better Stack · Watch on YouTube
Video authored by the channel shown, not by IANIA; all rights belong to the creator. Transcript and summary generated automatically; the original-language content is preserved.
Original language: English
Original video: GitHub App Keys Never Expire (Bad) · Channel: Better Stack · 01:01 · Watch on YouTube
Topics: Cybersecurity and software security, Open source and software ecosystems
Summary
Section titled “Summary”GitHub App private keys do not expire and can be used to mint tokens that access an organization’s data. GitGuardian tested thousands of leaked keys and found that 474 still authenticated, with 44 apps holding full organization admin rights. One key had been exposed in a public repository since 2020, while another had write access to private code for 17 months. The video recommends rotating GitHub App private keys and removing apps that no one owns.
Key points
Section titled “Key points”- GitHub Apps use a private key generated by the app owner.
- The private key does not expire and can sign a short-lived JWT lasting 10 minutes.
- The JWT can be exchanged for a one-hour access token with full permissions on every organization where the app is installed.
- GitGuardian tested thousands of leaked keys; 474 still authenticated.
- Of those, 44 apps had full organization admin rights.
- One key was found in a public repository dating back to 2020 and still worked.
- A key leaked in a repository linked to the US CDC had write access to private code for 17 months.
- GitHub allows up to 25 private keys per app, enabling owners to rotate keys without downtime.
- Organization owners should remove apps that no one owns anymore.
Chapters
Section titled “Chapters”| Start | Chapter | Summary |
|---|---|---|
| 00:00 | How GitHub App keys grant access | The video explains how non-expiring private keys create short-lived JWTs and access tokens for GitHub organizations. |
| 00:30 | Leaked keys and their impact | GitGuardian found hundreds of leaked keys that still authenticated, including keys with extensive access. |
| 01:01 | How to reduce exposure | The video advises app owners to rotate private keys and organization owners to remove unowned apps. |
Quotes
Section titled “Quotes”That key never expires — 00:00
474 still authenticated and 44 of those apps had full org admin rights. — 00:30
One key even leaked in a repo linked to the US CDC — 00:30
generate a new one and later delete the old one without any downtime. — 01:01
Concepts and entities
Section titled “Concepts and entities”GitHub App, private key, JWT, access token, GitGuardian, US CDC
Full transcript (original language)
Section titled “Full transcript (original language)”00:00 Security researchers found leaked GitHub keys that never expire giving full org admin access to anyone that found them. One key had even been in a public repo since 2020 and still worked. Let me explain. The apps you install on GitHub are powered by a private key that you generate. That key never expires and it can mint short-lived tokens to access your organizations data. The chain works like this. The private key signs a short-lived JWT that lasts 10 minutes, which can then be exchanged for a 1-hour
00:30 access token that has full permission on every org it’s installed on. So, a security research company called GitGuardian took thousands of leaked keys and tested every single one. 474 still authenticated and 44 of those apps had full org admin rights. One key even leaked in a repo linked to the US CDC and had write access to private code for 17 months. You could argue that this is just how key pairs work. Your SSH keys don’t expire either, which is fair. But, GitHub has guards for every token issues
01:01 except the one that dishes them out in the first place. So, if you own a GitHub app, rotate your private key. You can hold up to 25 at once, so generate a new one and later delete the old one without any downtime. And if you run an organization yourself, remove any apps nobody owns anymore. This is the easiest way to limit exposure. If you want to stay up-to-date with developer news like this, then subscribe to Better Stack.