Topic starter
14/07/2026 5:23 pm
TL;DR: Truffle Security reports that a GitHub App private key granting write access to CISA’s GitHub organisation stayed live two days after public disclosure, alongside other active tokens, passwords, and keys hidden in encoded Terraform configs. Secret removal is not remediation when discovery, revocation, and recursive decoding lag behind exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Truffle Security: “CISA's Leaked Admin GitHub Token Remained Live 2 Days After Krebs Reported It Leaked”.
Key questions
Q: What breaks when a leaked GitHub App key is treated like an ordinary file secret?
A: The incident response model breaks because the credential can stay valid after the file is removed, and the attacker may still be able to authenticate directly to the platform.
Q: Why do leaked non-human credentials require immediate revocation instead of simple deletion?
A: Because deletion only removes one copy of the exposure, while the credential may already exist in caches, archives, forks, or downstream systems that still trust it.
Q: How can security teams tell whether secret scanning is actually catching the risky credentials?
A: A useful programme finds nested, encoded, and context-dependent secrets, not just obvious plaintext keys.
Practitioner guidance
- Map every high-risk secret to an owner and a revocation path Build a credential register that ties each GitHub App key, token, password, and certificate to a system owner, issuer, and documented revocation procedure.
- Enable recursive secret detection in code and archive scans Scan Terraform, Docker, JSON, and archived repository content with recursive decoding so nested base64 and multi-layer encoded credentials are surfaced as live secrets.
- Separate file removal from credential invalidation Require a verified revocation step whenever a leaked secret is found, and confirm that the target service no longer accepts the credential.
Bottom line: The core problem is not only leaked credentials, but leaked credentials that remain valid after public disclosure and file deletion.
What's in the full analysis
Truffle Security's full article covers the operational detail this post intentionally leaves for the source:
- The exact GitHub App key validation steps used to confirm live access against the GitHub API
- The full breakdown of additional live tokens, passwords, and certificates found in the repository
- The decoding chain for the CrowdStrike credential buried inside nested base64 and Terraform content
- The disclosure timeline and rotation implications across multiple vendors and environments
👉 Read Truffle Security's analysis of CISA’s leaked GitHub admin key and secret sprawl →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 5:27 pm
Secret sprawl becomes a governance failure when the credential remains live after disclosure: The article is not really about one bad file, but about the gap between exposure, detection, and true revocation. Once a secret can survive public reporting for days, the control failure is lifecycle management, not simply repository hygiene. Practitioners should read this as evidence that secret inventory without validated revocation produces false confidence.
A question worth separating out:
Q: Should organisations prioritise GitHub App keys over low-value tokens during exposure response?
A: Yes. Organisation-wide GitHub App keys can change repository settings, manage runners, and expose workflow data, so they create a much larger blast radius than a typical service token. Exposure response should always sort credentials by reachable privilege and operational impact.
👉 Read our full editorial: CISA’s leaked GitHub admin key shows how secret sprawl persists