Teams lose the ability to tell which machine users, tokens, keys and apps still exist, so stale access persists unnoticed. That makes ownership unclear, revocation slower and attack paths harder to contain because no one can confidently say what is active or who is responsible for it.
What inventory tells you about GitHub NHIs
An inventory is the difference between “we think this exists” and “we can prove it exists right now.” For GitHub NHIs, that means you can separate active machine users, app registrations, deploy keys and tokens from leftovers that should already have been removed. Without that baseline, governance becomes guesswork and normal access review loses its target.
Inventory is not just a register of names, it is a control surface for ownership, scope and lifecycle. The moment a GitHub NHI is created, rotated, scoped or retired, the inventory should reflect it. That is why mature teams treat Ultimate Guide to NHIs as a parent concept for visibility, lifecycle and offboarding, not as a static catalogue.
When the inventory is missing, the organisation cannot reliably answer four practical questions: what non-human access exists, who owns it, what it can reach, and whether it should still be trusted. That uncertainty is what turns a routine GitHub account into an unmanaged security dependency.
Why stale GitHub access becomes hard to contain
Uninventoried NHIs tend to accumulate faster than teams can manually rediscover them, especially in GitHub environments with many repos, bots, CI systems and integration tokens. The result is stale access that survives after the original workflow, owner or project is gone. That stale access is still a live path into code, secrets, automation and sometimes deployment systems.
In practice, the failure is not only technical. The organisation loses the ability to identify which credentials are safe to keep, which should be rotated, and which should be revoked immediately. NHIMG’s Top 10 NHI Issues and Ultimate Guide to NHIs, Key Challenges and Risks both point to the same operational problem, visibility gaps make ownership and cleanup lag behind reality.
That lag matters because GitHub NHIs are often used in automated workflows, where a forgotten token or app can still authenticate long after the team that created it has moved on. The access may be legitimate in origin but illegitimate in present-day context, which is exactly why inventory is a security control and not just documentation.
What changes when you cannot see the active set
Once active NHIs are no longer inventoried, revocation becomes reactive instead of deliberate. Teams often discover the gap only after a service fails, a secret is rotated, or an access review exposes something that should have been removed months earlier. That is a governance failure, but it is also an attack-path problem because unknown GitHub access can be chained into repository access, secret theft, or CI compromise.
For GitHub specifically, inventory gaps usually show up as orphaned app grants, unused deploy keys, personal access tokens that outlive their purpose, and service accounts no one can confidently own. The practical impact is slower response, weaker accountability and a larger blast radius when one credential is abused. NHIMG’s NHI Ownership and Accountability Guide and Service Account Security Guide are useful companions here because they reinforce that ownership and lifecycle control are inseparable from visibility.
Without inventory, teams also lose the ability to distinguish a tolerated exception from an abandoned credential. That distinction matters more than most people expect, because exception handling depends on knowing whether the control failure is temporary, approved, or simply forgotten.
Risk and Threat Considerations
Missing inventory turns GitHub NHIs into hidden exposure. The main risk is not that every unknown token is already abused, but that the organisation cannot quickly tell which ones are still active, over-scoped, or reachable from production workflows.
Failure mechanism: Attackers and insiders benefit from long-lived, untracked GitHub credentials because they can persist in automation, bypass normal review cycles, and remain usable after the original owner has left or the integration has changed.
Impact: Compromise becomes harder to detect and contain, revocation takes longer, and stale access can be used to reach repositories, pipelines or secrets before defenders even know the asset existed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 provides the primary governance reference for this topic.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Missing inventory leaves retired GitHub NHIs active and unowned. |
| NHI-02 — Secret Leakage | Uninventoried GitHub NHIs can hide exposed tokens and keys. | |
| NHI-05 — Overprivileged NHI | Unknown GitHub NHIs often retain more access than their current use requires. | |
| Recommendation — Track and revoke GitHub NHIs at offboarding so abandoned access is removed promptly. Inventory and rotate GitHub secrets before they become undiscovered exposure points. Review GitHub NHI scopes and remove excess privilege when ownership is unclear. | ||
Practitioner Guidance
What to verify: Treat the inventory as complete only when every GitHub NHI has a recorded owner, purpose, authentication method, scope and expiry or review date. If any of those fields are missing, you do not have a trustworthy control baseline yet.
Decision rule: If a GitHub token, app or machine user cannot be traced to an accountable owner and current business purpose, prioritise discovery and revocation planning over further optimisation. Unknown ownership is itself a reason to treat the access as higher risk.
What good looks like: You can answer, without manual archaeology, which NHIs are active, which are dormant, which are privileged and which are waiting for deletion. The practitioner goal is not perfection, but fast confidence that stale access will not survive quietly. When you can do that, inventory stops being a spreadsheet and becomes an enforcement point.
Practitioner takeaway: If you cannot inventory GitHub NHIs, you cannot govern them with confidence, and every delayed revocation increases the chance that forgotten access becomes an active attack path.