GitHub Personal Access Token Leaked in Code

What Is This Vulnerability?

A GitHub personal access token (PAT) has been hardcoded into source files, CI configuration, or scripts. These tokens grant access to repositories, organizations, and GitHub APIs with the same permissions as the token owner, allowing attackers to read private repos, push malicious code, or delete resources.

Why It Happens

Developers embed tokens directly into automation scripts, CI pipelines, or API client code for convenience. Tokens are sometimes pasted into code during debugging and left behind. GitHub CLI commands with inline tokens in shell history can also end up committed in scripts.

Example Code

import { Octokit } from "@octokit/rest";

const octokit = new Octokit({
  auth: "ghp_ABCDeFgHiJkLmNoPqRsTuVwXyZ0123456789",
});

async function getRepos() {
  return octokit.repos.listForAuthenticatedUser();
}

import { Octokit } from "@octokit/rest";

const octokit = new Octokit({
  auth: process.env.GITHUB_TOKEN,
});

async function getRepos() {
  if (!process.env.GITHUB_TOKEN) {
    throw new Error("GITHUB_TOKEN environment variable is required");
  }
  return octokit.repos.listForAuthenticatedUser();
}

How Hackers Exploit It

Automated scanners constantly search GitHub for token patterns starting with ghp_, gho_, or github_pat_. Once a valid token is found, attackers can clone private repositories, inject backdoors into codebases, create releases with malware, access organization secrets, and pivot to other systems using information from private repos.

How to Fix It

Never hardcode GitHub tokens. Use environment variables or GitHub Actions secrets for CI/CD. Immediately revoke any token that has been committed by going to GitHub Settings, then Developer Settings, then Personal Access Tokens. Enable GitHub secret scanning on your repositories. Use fine-grained tokens with minimal required permissions.

Frequently Asked Questions