“After reviewing the permissions granted to each valid GitHub PAT, we discovered the majority (67%) had admin-level privileges.”
Truffle Security found 4,500 of the most visited sites serving their .git directory to anyone who asked. Inside were full source trees, live API keys for Mailgun, Sendgrid and other email services, and one private key for a site’s own TLS certificate. Every leaked GitHub token had repo permissions, enough to plant malware in the code. A second scan a month later still found 97 live keys.