Leaked GitHub PAT — repo exfiltration and supply-chain risk

GitHub PATs grant repo-level access to the issuing account. A leaked classic PAT with `repo` scope gives an attacker read and write on every private repo the user can access. Fine-grained PATs are scoped but still dangerous.

The next 60 seconds matter

The attacker clones every private repo accessible to the token, searches for secondary secrets in git history, and optionally pushes poisoned commits (supply-chain attack) if the token has write scope on public packages.

  • Clone every private repo the token can see
  • Grep for additional API keys in git history
  • Push poisoned commits to npm/pypi packages if token has write + you publish
  • Add themselves as collaborator on any repo they can reach

Rotation playbook

  1. github.com/settings/tokens → Delete the leaked token
  2. Audit sessions at github.com/settings/security — revoke anything suspicious
  3. Review audit log of any org the token had access to
  4. Rotate any secondary secrets found in the affected repos (they are now also compromised)

Prevent the next one

  • Use fine-grained PATs with the minimum necessary scope, not classic PATs
  • Use short expiration (90 days max)
  • Prefer GitHub Apps over PATs for automation
  • Enable 2FA and require SSO for org access
Pattern we scan for
ghp_... (classic) or github_pat_... (fine-grained)