GitHub Apps Leave 474 Leaked Keys Live

// 1h agoSECURITY INCIDENT

GitHub Apps Leave 474 Leaked Keys Live

GitGuardian found 474 publicly leaked GitHub App private keys still authenticating, including 44 apps with full organization-admin access. Because these keys do not expire automatically, forgotten secrets can remain long-lived supply-chain entry points.

// ANALYSIS

GitHub Apps make automation powerful, but non-expiring private keys turn ordinary secret leaks into persistent organizational risk.

–474 of 4,802 tested keys remained valid, spanning 440 distinct apps
–72% could read private repositories, while 207 could write to them
–Compromised apps can affect every repository covered by their installations
–Developers should store keys in vaults, rotate them regularly, and revoke leaked keys immediately
–GitHub’s secret scanning must be paired with app-installation and permission inventory

// TAGS

github-appssecurityapiautomationci-cd

DISCOVERED

1h ago

2026-10-04

PUBLISHED

1h ago

2026-10-04

RELEVANCE

7/ 10

AUTHOR

Better Stack

// KEEP READING

More AI developer news from the feed

EXPLORE FULL FEED

UPDATE1h ago

AI Tracker Opens Searchable Model-Detection Hub

AI Tracker now offers a searchable home for its model and leak detections, with live updates, evidence pages, model timelines, and alerts across Discord, X, email, and browser push. The service monitors 145+ sources, including APIs, documentation, app bundles, leaderboards, and leak accounts.

MODEL3h ago

Whistle Packs Multilingual Speech-to-Text into 16.9 MB.

Cactus Compute released Whistle, an open CPU speech-recognition model that transcribes seven languages, supports 30-second inputs, word timestamps, speech embeddings, and on-device processing. It shares the Needle runtime and weighs just 16.9 MB. [Cactus launch post](https://www.cactuscompute.com/blog/whistle)

RESEARCH3h ago

TactileStep Makes Humanoid Landings Softer

Tsinghua’s TactileStep adds sole-pressure feedback to Unitree G1 locomotion policies, using contact force, center of pressure, and loaded-area signals to regulate touchdown and stance. Tests across varied terrain report up to 48.8% lower touchdown force and 23.8% greater stance contact area. [Official project page](https://tactilestep.github.io/) · [Paper](https://arxiv.org/abs/2609.28959)