CD Consulting R&D

KB-RISK · Entry 3 · Published 8 September 2026 · Version 1

Keeping secrets and code on GitHub: what the last four years of incidents teach a small organisation

Where should a small organisation keep its API keys and recovery codes, and what does it risk by trusting a repository with them?

If you keep API keys in a private repository, read this before the next backup runs.

Review compiled from public sources; all sources consulted on 8 September 2026. Vendor blogs are used to describe incidents they investigated, never for their product claims. Figures are quoted with their source; nothing is estimated.

Contents

1. Summary
2. 1. Scope and method
3. 2. What the incidents show — six families
4. 3. What GitHub has changed
5. 4. What it means for a small organisation with static websites
6. 5. Recommendations — in order of principle, then cost
7. 6. Sources

Summary

• GitHub is a code-hosting platform, not a vault. A private repository is a repository with a flag: every token with repo scope on a workstation, every authorised OAuth app and every past collaborator reads it. Git also keeps what it is given: commits stay reachable by hash after deletion or a change of visibility [S9][S10].
• Secrets are leaking faster, and stay valid. About 29 million new hard-coded secrets reached public GitHub in 2025, up 34 % in a year; 64 % of valid secrets leaked in 2022 had still not been revoked in 2026; secrets tied to AI services grew 81 % [S1][S2].
• The attack surface has moved to the pipeline and the workstation. The major incidents of 2025–2026 did not break GitHub's cryptography; they stole a maintainer's token (tj-actions, March 2025 [S3][S4]), propagated through npm with a self-replicating worm (Shai-Hulud, September 2025 [S5]), pushed 5,718 malicious commits into 5,561 repositories in six hours from credentials stolen by info-stealers (Megalodon, May 2026 [S6][S7]), and entered GitHub's own internal repositories through a poisoned VS Code extension (May 2026 [S8]).
• The platform's defences have improved measurably — mandatory two-factor authentication, push protection on by default for public repositories, npm trusted publishing and a 2026 roadmap that locks Actions dependencies by commit hash [S11][S12][S13][S14] — but every one of them protects the platform's side of the perimeter. The user's side is the workstation, the tokens it stores, and the discipline of never writing a secret into a file that git, a backup job or an AI agent can read.
• Practical rule for a one-person organisation: credentials live in a password manager (an offline KeePassXC database backed up as an encrypted file, or an end-to-end encrypted hosted manager), never in a repository of any visibility; anything that has ever been committed or copied in clear text is rotated; accounts use passkeys or hardware keys, not SMS; personal access tokens are fine-grained, scoped and dated [S15][S16][S17].

1. Scope and method

This note answers a concrete question — where should a small organisation keep API keys, recovery codes and other secrets, and what does it risk by relying on GitHub? — and grounds the answer in documented incidents rather than in vendor advice. It covers github.com (the hosted service), GitHub Actions and the npm registry that GitHub operates, over 2022–2026. It does not cover GitHub Enterprise Server. Sources are listed in section 6 with their type: official (GitHub, CISA, ANSSI, CNIL, NIST), security-research publications, and technology press for facts that the primary source did not publish.

2. What the incidents show — six families

2.1 Secrets committed to repositories

GitGuardian's fifth annual report, published on 17 March 2026, counts about 29 million new hard-coded secrets pushed to public GitHub during 2025, a 34 % year-on-year increase described as the largest single-year jump the firm has recorded; leaked secrets have grown 152 % since 2021 while the public developer base grew 98 % [S1][S2]. Two findings matter more than the headline. First, 64 % of the valid secrets found in 2022 were still not revoked in 2026 [S1]: a leaked key is not a transient event but a standing door. Second, the growth is driven by AI tooling: leaks of AI-service credentials rose 81 %, eight of the ten fastest-growing categories are AI services, secret-leak rates in AI-assisted code were roughly double the GitHub-wide baseline over the year, and 24,008 unique secrets were found in configuration files of MCP servers (the protocol that connects AI agents to tools), 2,117 of them verified as valid [S1][S2]. Internal repositories are reported to be six times more likely than public ones to contain secrets [S2] — the private flag does not make people more careful; it makes them less.

2.2 Data that does not go away

In July 2024, Truffle Security documented what it called a Cross Fork Object Reference: commit data in a fork network remains reachable by commit hash even after the fork, or the original repository, has been deleted or made private; short hashes can be brute-forced through the web interface. GitHub answered that this is an intentional design decision and documented behaviour [S9]. GitHub's documentation confirms the mechanics: when a private repository is made public, all its commits — including commits previously pushed to private forks — migrate to a new public network [S10]. In February 2025, Lasso Security showed a second persistence channel: content of more than 20,000 repositories belonging to more than 16,000 organisations that had once been public and had since been made private was still retrievable through Microsoft Copilot, because Bing had cached it [S18]. The lesson is not that GitHub is careless; it is that publication is irreversible, and that "private" describes the present, not the past.

2.3 The CI/CD supply chain

tj-actions/changed-files, 14–15 March 2025. An attacker who had obtained the personal access token of the maintainer's bot account rewrote the version tags of a GitHub Action used by more than 23,000 repositories so that they pointed to a malicious commit which dumped workflow secrets — access keys, personal access tokens, npm tokens, private RSA keys — into build logs. Tracked as CVE-2025-30066 (CVSS 8.6) with a linked compromise of reviewdog/action-setup (CVE-2025-30154), it was added to CISA's Known Exploited Vulnerabilities catalogue on 18 March 2025 [S3][S4]. One stolen token, one mutable tag, 23,000 downstream victims.

Nx / "s1ngularity" (late August 2025) and Shai-Hulud (from 15 September 2025). Wiz Research traces a chain from GitHub-token theft in the Nx compromise to npm-token theft to mass package poisoning: the Shai-Hulud payload ran the TruffleHog secret scanner on the victim's machine, created public repositories named "Shai-Hulud" to publish the harvested secrets, pushed a malicious workflow to every repository the stolen GitHub token could reach, and — the first self-propagating attack seen on npm — used any npm token it found to publish poisoned versions of further packages. Hundreds of packages were affected within a day; a second wave in November 2025 touched more than 400 packages [S5].

TanStack (May 2026). A compromise of the TanStack/router and TanStack/start repositories' GitHub Actions pipeline produced 84 malicious versions across 42 @tanstack npm packages and spread to secondary victims including Mistral AI and UiPath, and to more than 160 further npm and PyPI packages, according to the incident analysis published by Rescana [S19].

Megalodon, 18 May 2026. Between 11:36 and 17:48 UTC, 5,718 commits were pushed to 5,561 repositories under four rotating author names (build-bot, auto-ci, ci-bot, pipeline-bot), each adding a GitHub Actions workflow with a base64-encoded shell payload that exfiltrated CI secrets, cloud credentials, SSH keys and OIDC tokens to a command-and-control server [S6][S7]. More than a third of the affected usernames matched machines already infected by information-stealing malware [S6]: the credentials were not guessed, they had been harvested from developers' own computers.

2.4 Account takeover and social engineering

Two campaigns in 2025 exploited legitimate GitHub features rather than flaws. In March 2025, fake "Security Alert" issues were filed against nearly 12,000 repositories, steering developers to authorise a malicious OAuth application that granted full control of their accounts [S20]. From June 2025, device-code phishing abused GitHub's OAuth device authorisation flow: the attacker starts a device-code request using a legitimate client identifier (Visual Studio Code's, for instance), then talks the developer — often by phone, posing as IT support — into entering the code on GitHub's own verification page; the token that results gives access to code, Actions secrets and repositories. Authorised security engagements report success rates above 90 % for the technique [S21][S22]. Upstream of all of this sit information stealers on the workstation, the origin of the Megalodon credentials [S6].

2.5 Malicious content on the platform

The platform is also used as a distribution channel. Check Point Research described in 2024 the Stargazers Ghost Network: more than 3,000 fake accounts that star, fork and watch each other's repositories so that malware-hosting repositories look popular — a distribution-as-a-service that earned its operator an estimated 100,000 dollars and infected 1,300 victims in four days of one campaign [S23]. Stars are a social signal, not a security one.

2.6 The platform itself

GitHub has been a victim three times in the period. In April 2022, OAuth user tokens issued to Heroku and Travis CI were stolen and used to list organisations and clone private repositories across dozens of organisations, and to obtain an AWS key from a downloaded npm repository [S24]. In March 2023, GitHub's own RSA SSH host private key was briefly exposed in a public repository and had to be replaced, forcing every RSA user to update their known hosts [S25]. On 18 May 2026, GitHub confirmed that a malicious version of the Nx Console extension — live on the Visual Studio Marketplace for only 18 minutes — had compromised an employee's device and allowed exfiltration from its internal repositories; the group TeamPCP claimed about 3,800 repositories; GitHub rotated critical credentials overnight and announced a post-incident report [S8]. The same organisation that runs secret scanning for the world was entered through a developer's editor plug-in.

3. What GitHub has changed

Measured against the incidents above, GitHub's defences have grown in three layers.

Identity. Two-factor authentication became mandatory for contributors; GitHub reports nearly 1.4 million passkeys registered since July 2023, a 25 % fall in the share of SMS as a second factor and a 47 % higher likelihood that users register two or more factors [S11]. Fine-grained personal access tokens with scopes and expiry dates exist alongside classic tokens; a credential-revocation API extended to OAuth and App tokens in March 2026, and self-service revocation for enterprises in June 2026 [S14].

Secrets. Secret scanning with push protection — the commit is refused before it reaches the server — is on by default for public repositories; base64-encoded secrets are detected since November 2025; validity checks and new partner patterns (Supabase and Slack among them) were added in June 2026, and extended metadata on leaked secrets in February 2026 [S12][S13]. Push protection is a net, not a wall: it catches known patterns at push time and cannot see what was already in the history.

Pipeline. For npm: high-impact accounts are put into a 72-hour read-only mode when their credentials change, trusted publishing was extended, staged publishing requires a second two-factor approval, and npm v12 disables install-time scripts by default (June 2026) — the very mechanism Shai-Hulud used [S14]. For Actions: safer pull_request_target defaults and workflow-execution policies (June 2026), a Dependabot cool-down of at least three days before a new package version is proposed (July 2026) [S14], and a 2026 roadmap published on 26 March 2026 that adds a dependencies: section locking every action to a commit SHA, secrets scoped to specific workflows and environments, separation of write access from secret management, and an egress firewall for hosted runners, with public previews within three to nine months [S13].

None of these measures would have prevented a maintainer from pasting a key into a private repository, nor an info-stealer from reading a token in a browser profile.

4. What it means for a small organisation with static websites

The organisation behind this note publishes static pages from public repositories, runs no build pipeline and stores no deployment secret on GitHub. Its exposure is therefore not the CI/CD family of section 2.3 but the two quieter ones: credentials on the workstation and the temptation to use a private repository as a backup for sensitive files. Five facts settle the second point.

5. Recommendations — in order of principle, then cost

1. Secrets never enter git, whatever the visibility. Keep API keys, recovery codes and passwords in a password manager. For a single-user, single-workstation organisation that values independence from cloud services, an offline KeePassXC database is sufficient: AES-256 file encryption under a long master passphrase, no account; KeePass holds a first-level security certification (CSPN) from ANSSI, and ANSSI/CNIL, NIST SP 800-63B-4 (2025) and CISA all endorse password managers [S15][S16][S17]. The encrypted database file may be backed up to a synchronised drive and an external disk; the master passphrase and printed recovery codes stay on paper.
2. Rotate anything that has ever been written in clear text — in a scratch folder, a backup snapshot, a chat, a prompt. Treat it as leaked; the 64 % figure is the cost of not doing so [S1].
3. Harden the account, not just the repository: passkeys or FIDO2 keys as second factor, no SMS; review authorised OAuth applications and personal access tokens periodically; prefer fine-grained tokens with an expiry date and the minimum scope; know the device-code flow well enough to refuse a code that someone else asked you to enter [S11][S21][S22].
4. Set organisation-level defaults: two-factor required for members, secret scanning and push protection on, branch protection on the published branch, no third-party Actions unless pinned to a commit SHA, Dependabot on [S12][S13].
5. Treat the workstation as the perimeter: vet editor extensions (the vector of GitHub's own breach [S8]), keep a separate browser profile for administrative accounts, and assume that anything an AI agent can read, it may also copy — including MCP configuration files [S1].
6. Decide visibility once, at creation. A repository that might one day be made public must never have contained a secret, because the history follows it [S9][S10]; and a repository made public is public forever in caches even after it is closed [S18].

6. Sources

All consulted on 2026-09-08.

1. S1 GitGuardian, The State of Secrets Sprawl 2026 (report, 17 March 2026) — https://www.gitguardian.com/state-of-secrets-sprawl-report-2026 ; summary blog https://blog.gitguardian.com/the-state-of-secrets-sprawl-2026/ (security research).
2. S2 The Hacker News, The State of Secrets Sprawl 2026: 9 Takeaways for CISOs (March 2026) — https://thehackernews.com/2026/03/the-state-of-secrets-sprawl-2026-9.html (press, relaying [S1]).
3. S3 CISA, Supply Chain Compromise of Third-Party tj-actions/changed-files (CVE-2025-30066) and reviewdog/action-setup@v1 (CVE-2025-30154), alert of 18 March 2025 — https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction (official).
4. S4 Wiz Research, GitHub Action tj-actions/changed-files supply chain attack (CVE-2025-30066) — https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066 ; GitHub Advisory GHSA-mrrh-fwg8-r2c3 — https://github.com/advisories/ghsa-mrrh-fwg8-r2c3 (research / official).
5. S5 Wiz Research, Shai-Hulud npm supply chain attack (September 2025) — https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack ; second wave: Netskope, Shai-Hulud 2.0 — https://www.netskope.com/blog/shai-hulud-2-0-aggressive-automated-one-of-fastest-spreading-npm-supply-chain-attacks-ever-observed (research).
6. S6 StepSecurity, Megalodon: Mass GitHub Actions Secret Exfiltration Across 5,500+ Public Repositories (May 2026) — https://www.stepsecurity.io/blog/megalodon-mass-github-actions-secret-exfiltration-across-5-500-public-repositories ; SafeDep, Megalodon: Mass GitHub Repo Backdooring via CI Workflows — https://safedep.io/megalodon-mass-github-repo-backdooring-ci-workflows/ (research).
7. S7 The Hacker News, Megalodon GitHub Attack Targets 5,561 Repos with Malicious CI/CD Workflows (May 2026) — https://thehackernews.com/2026/05/megalodon-github-attack-targets-5561.html (press).
8. S8 BleepingComputer, GitHub confirms breach of 3,800 repos via malicious VSCode extension (May 2026) — https://www.bleepingcomputer.com/news/security/github-confirms-breach-of-3-800-repos-via-malicious-vscode-extension/ ; Help Net Security, 20 May 2026 — https://www.helpnetsecurity.com/2026/05/20/github-breached-teampcp/ (press; GitHub's post-incident report announced, not yet consulted).
9. S9 Truffle Security, Anyone can Access Deleted and Private Repository Data on GitHub (July 2024) — https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github (research).
10. S10 GitHub Docs, What happens to forks when a repository is deleted or changes visibility? — https://docs.github.com/articles/what-happens-to-forks-when-a-repository-is-deleted-or-changes-visibility (official).
11. S11 GitHub Blog, Securing millions of developers through 2FA — https://github.blog/security/supply-chain-security/securing-millions-of-developers-through-2fa/ (official).
12. S12 GitHub Docs, About push protection — https://docs.github.com/en/code-security/secret-scanning/introduction/about-push-protection ; GitHub Docs, Secret scanning REST API — https://docs.github.com/en/rest/secret-scanning/secret-scanning (official).
13. S13 GitHub Blog, What's coming to our GitHub Actions 2026 security roadmap (26 March 2026, updated 30 March 2026) — https://github.blog/news-insights/product-news/whats-coming-to-our-github-actions-2026-security-roadmap/ (official).
14. S14 GitHub Blog, Disrupting supply chain attacks on npm and GitHub Actions (28 July 2026) — https://github.blog/security/supply-chain-security/disrupting-supply-chain-attacks-on-npm-and-github-actions/ (official).
15. S15 ANSSI / CNIL, Recommandations relatives à l'authentification multifacteur et aux mots de passe, ANSSI-PG-078 (8 October 2021) — https://messervices.cyber.gouv.fr/documents-guides/anssi-guide-authentification_multifacteur_et_mots_de_passe.pdf ; CNIL, Mots de passe : recommandations pour maîtriser sa sécurité — https://www.cnil.fr/fr/mots-de-passe-recommandations-pour-maitriser-sa-securite (official).
16. S16 NIST, SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (2025) — https://pages.nist.gov/800-63-4/sp800-63b.html — "verifiers SHALL allow the use of password managers" (official). Workstation credential storage: GitHub CLI and Git Credential Manager documentation, https://cli.github.com/manual/gh_auth_login (official).
17. S17 CISA, Releases Guidance on Credential Risks Associated with Potential Legacy Oracle Cloud Compromise (16 April 2025) — recommendation to remove hard-coded credentials from code and configuration — https://www.cisa.gov/news-events/alerts/2025/04/16/cisa-releases-guidance-credential-risks-associated-potential-legacy-oracle-cloud-compromise (official).
18. S18 Lasso Security, Lasso Uncovers Sensitive Private GitHub Repositories Exposed in Microsoft Copilot via Bing Cache (February 2025) — https://www.lasso.security/resources/lasso-uncovers-sensitive-private-github-repositories-exposed-in-microsoft-copilot ; TechCrunch, 26 February 2025 — https://techcrunch.com/2025/02/26/thousands-of-exposed-github-repositories-now-private-can-still-be-accessed-through-copilot (research / press).
19. S19 Rescana, TanStack npm Supply Chain Attack: Detailed Analysis of the May 2026 GitHub Actions Breach — https://www.rescana.com/post/tanstack-npm-supply-chain-attack-detailed-analysis-of-the-may-2026-github-actions-breach-and-multi-ecosystem-impact (research; single source, to be corroborated before publication).
20. S20 BleepingComputer, Fake "Security Alert" issues on GitHub use OAuth app to hijack accounts (March 2025) — https://www.bleepingcomputer.com/news/security/fake-security-alert-issues-on-github-use-oauth-app-to-hijack-accounts/ (press).
21. S21 Cybersecurity News, New GitHub Device Code Phishing Attacks Targeting Developers to Steal Tokens (June 2025) — https://cybersecuritynews.com/new-github-device-code-phishing-attacks/ (press).
22. S22 Palo Alto Networks Unit 42, Device-Code-based OAuth Phishing (timely threat intel, 23 March 2026) — https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-03-23-%20Device-Code-based-OAuth-Phishing.txt (research).
23. S23 Check Point Research, Stargazers Ghost Network (July 2024) — https://research.checkpoint.com/2024/stargazers-ghost-network/ (research).
24. S24 GitHub Blog, Security alert: Attack campaign involving stolen OAuth user tokens issued to two third-party integrators (15 April 2022, updated 27 April 2022) — https://github.blog/2022-04-15-security-alert-stolen-oauth-user-tokens/ (official).
25. S25 GitHub Blog, We updated our RSA SSH host key (23 March 2023) — https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/ (official).

Limits of this review. Incident figures for 2026 (TanStack, Megalodon, the GitHub breach) come from research firms and press; GitHub's own post-incident report on the May 2026 breach had not been published at the time of writing. The GitGuardian figures are those of a vendor of secret-detection tools, published in a methodology-documented annual report and widely relayed; they are used for orders of magnitude, not for precision. No figure in this note was computed by its author.