{"id":5135,"date":"2026-09-24T07:55:54","date_gmt":"2026-09-24T07:55:54","guid":{"rendered":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/09\/24\/github-gives-enterprises-a-full-count-of-who-holds-the-keys\/"},"modified":"2026-09-24T07:55:54","modified_gmt":"2026-09-24T07:55:54","slug":"github-gives-enterprises-a-full-count-of-who-holds-the-keys","status":"publish","type":"post","link":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/09\/24\/github-gives-enterprises-a-full-count-of-who-holds-the-keys\/","title":{"rendered":"GitHub Gives Enterprises a Full Count of Who Holds the Keys"},"content":{"rendered":"
\"\"<\/div>\n

\"\"<\/p>\n

Most security teams can tell you how many people work in engineering. Far fewer can tell you how many credentials those people, and the apps they\u2019ve installed, hold against the company\u2019s source code. That gap is where a lot of trouble starts.<\/span><\/p>\n

GitHub wants to close it. On September 21, the company announced that GitHub Enterprise Cloud owners can now export a full inventory of every credential that can access their enterprise. The export covers SSH keys, classic and fine-grained personal access tokens (PATs), OAuth app access tokens, and GitHub App user-to-server and installation tokens.<\/span><\/p>\n

Teams can pull the list as a CSV from Enterprise Settings, under Authentication Security, or through a paginated REST API. They can filter by user, app, credential type, or organization. Each record includes the owner, scopes, creation and expiration dates, and the last time the credential was used. GitHub says teams can correlate that data with audit logs to see how credentials are actually being used.<\/span><\/p>\n

Access isn\u2019t limited to enterprise owners. GitHub added a fine-grained permission, \u201cView enterprise credentials,\u201d so security or compliance staff can run reviews without holding full admin rights. That\u2019s a small detail, but it matters. The people who audit credentials often aren\u2019t the people who should be able to change enterprise settings. Support for GitHub Enterprise Server is planned for upcoming releases.<\/span><\/p>\n

The timing makes sense. Credentials have become the easiest way into software supply chains. In May, GitHub disclosed that attackers exfiltrated about 3,800 of its internal repositories after an employee installed a poisoned version of the Nx Console VS Code extension. Researchers noted that extensions like that can reach everything on a developer\u2019s machine, including SSH keys and cloud credentials. GitHub\u2019s response included rotating critical secrets, \u201cwith the highest-impact credentials prioritized first.\u201d<\/span><\/p>\n

That phrase describes the hard part. Prioritizing rotation assumes you know what you have. Many organizations don\u2019t.<\/span><\/p>\n

GitGuardian\u2019s State of Secrets Sprawl 2026 report puts numbers on the problem. It found 28.65 million hardcoded secrets added to public GitHub in 2025, up 34% from the year before. It also found that 64% of valid secrets detected in 2022 were still active and exploitable as of January 2026. Internal repositories were about six times more likely than public ones to contain hardcoded secrets.<\/span><\/p>\n

The new inventory doesn\u2019t cover hardcoded secrets. Those are a different problem. But the pattern is the same. Credentials get created for a task, then outlive the task, the project, and sometimes the employee. A PAT made for a one-off migration script three years ago may still carry write access today. An OAuth app someone authorized during a vendor trial may still hold a token. Nobody revoked it because nobody remembered it existed.<\/span><\/p>\n

Agentic AI raises the stakes. Coding agents, CI bots, and AI assistants all need tokens to read and write code. Every agent a team adds is another non-human identity with its own credentials, often created in a hurry and scoped broadly to get a pilot working. As agents spread across teams, the credential count grows faster than any manual review can keep up with.<\/span><\/p>\n

\u201cAnyone building with AI can now create credentials, and accountability for them lands back on IT and security,\u201d said Mitch Ashley, vice president and practice lead for CIO & technology buyers and software lifecycle engineering at The Futurum Group<\/a>. \u201cEnterprises that ignore that gap discover it during incident response, rotating keys they didn\u2019t know existed.\u201d<\/span><\/p>\n

An exportable inventory changes what a review looks like. Instead of chasing individual org admins for lists, a platform or security team can pull one dataset and ask direct questions. Which tokens have no expiration date? Which haven\u2019t been used in 90 days? Which classic PATs still carry broad scopes when a fine-grained token would do? Which GitHub Apps hold installation tokens in organizations that no longer use them?<\/span><\/p>\n

For most practitioners, the API is the more useful piece. It lets teams build the review into daily operations. Pull the inventory on a schedule, compare it against the last run, flag new long-lived tokens, and send stale ones to their owners for cleanup. Feed the results into existing SIEM or identity governance tools, so credential hygiene sits next to the identity data security teams already watch.<\/span><\/p>\n

Ashley said how often teams pull the data matters. \u201cPulled once a quarter, a credential inventory is an audit artifact,\u201d he said. \u201cPulled daily via the API and compared run-over-run, it becomes an operating control.\u201d<\/span><\/p>\n

There are limits. An inventory shows what exists. It doesn\u2019t revoke anything or enforce policy on its own. \u201cThe next step to watch is policy enforcement, since an inventory still depends on someone acting on what it finds,\u201d Ashley said. Until then, teams need to decide what \u201ctoo old\u201d or \u201ctoo broad\u201d means, and they need a process to act on it. Credentials that live outside GitHub, such as cloud keys stored in a CI variable or a token pasted into a Slack thread, won\u2019t show up here. And GitHub Enterprise Server customers will have to wait.<\/span><\/p>\n

Still, visibility comes first. You can\u2019t set expiration policies, enforce least privilege, or respond quickly to a breach without knowing which keys are out there and who holds them. For most enterprises, the first export will likely turn up credentials nobody knew were still active. That\u2019s an uncomfortable finding. It\u2019s also the point.<\/span><\/p>\n

Read More<\/a><\/p>\n

\u200b<\/p>","protected":false},"excerpt":{"rendered":"

Most security teams can tell you how many people work in engineering. Far fewer can tell you how many credentials […]<\/p>\n","protected":false},"author":1,"featured_media":5136,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[5],"tags":[],"class_list":["post-5135","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devops"],"_links":{"self":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/5135","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/comments?post=5135"}],"version-history":[{"count":0,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/5135\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media\/5136"}],"wp:attachment":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media?parent=5135"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/categories?post=5135"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/tags?post=5135"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}