GitHub Gives Enterprises a Full Count of Who Holds the Keys

GitHub has introduced a feature allowing enterprise customers to export a comprehensive inventory of all credentials used to access their platforms. This includes SSH keys, personal access tokens (PATs), OAuth app access tokens, and various GitHub App tokens. The export is available as a CSV file or through a paginated REST API, enabling teams to filter data by user, app, credential type, or organization. Each entry includes details like the owner, scopes, creation and expiration dates, and the last usage time.

Enterprise owners can view this inventory without full administrative privileges, thanks to a new fine-grained permission that allows security or compliance staff to review credentials without controlling enterprise settings. GitHub plans to extend this feature to GitHub Enterprise Server in future updates.

The announcement comes amid growing concerns over the ease with which attackers can gain unauthorized access to software supply chains through stolen or misused credentials. In May, GitHub disclosed that an employee's misuse of the Nx Console VS Code extension led to the theft of approximately 3,800 internal repositories. Researchers noted that such vulnerabilities can extend to SSH keys and cloud credentials.

While the export feature does not cover hardcoded secrets, which are a separate issue, it highlights a broader problem. Many organizations inadvertently create credentials that outlive their purpose, such as persistent personal access tokens or OAuth apps that remain active even after their owners leave the company. The emergence of agentic AI and coding agents further complicates the situation by introducing additional non-human identities with their own credentials, often created hastily and without proper oversight.

Mitch Ashley, vice president and practice lead at The Futurum Group, emphasized the importance of this inventory in incident response. By providing a single dataset, teams can more effectively audit and manage their credentials, identifying issues like tokens with no expiration dates, unused credentials, or overly broad scopes. However, the inventory alone does not revoke credentials or enforce policies; it merely provides visibility.

Teams must still decide on policies for old or broad credentials and implement processes for remediation. While the export feature brings valuable visibility, access to credentials stored outside GitHub, such as cloud keys, remains outside its scope, and GitHub Enterprise Server customers will need to wait for similar functionality.