GitHub lets enterprise owners export every token that can reach their code

Last use and expiration are the two columns that make a credential review finishable. GitHub's export puts them in the same row as the owner, the scopes and the creation date, one row per credential ^[4]. A platform team can sort for credentials with no expiration date, for those unused in the last 90 days, and for classic PATs that still carry broad scopes, instead of asking each org admin for a list ^[18]. GitHub says the data can be correlated with audit logs to show how a credential is actually being used ^[5].

What teams tell themselves is that a token gets made for a task and cleaned up when the task ends. What happens is that the credential outlives the task and the project, and a PAT written for a one-off migration script three years ago still carries write access ^[17]. GitGuardian reported that 64% of the valid secrets it detected in 2022 were still active and exploitable in January 2026 ^[11].

The inventory does not reach secrets pasted into code ^[13], and the counted volume sits there. GitGuardian's State of Secrets Sprawl 2026 found 28.65 million hardcoded secrets added to public GitHub during 2025, up 34% on the previous year ^[10]. A 34% rise implies roughly 21.4 million in 2024 and about 7.3 million more last year, close to 78,000 new hardcoded secrets a day ^[20][21]. Internal repositories were around six times more likely than public ones to contain one ^[12].

In May, GitHub disclosed that attackers exfiltrated about 3,800 of its internal repositories after an employee installed a poisoned version of the Nx Console VS Code extension ^[8]. Its response included rotating critical secrets, "with the highest-impact credentials prioritized first" ^[9].

"Anyone building with AI can now create credentials, and accountability for them lands back on IT and security," said Mitch Ashley, vice president and practice lead for CIO and technology buyers and software lifecycle engineering at The Futurum Group ^[14][16]. "Enterprises that ignore that gap discover it during incident response, rotating keys they didn't know existed," he said ^[15]. Every agent a team adds is another non-human identity with its own tokens, often scoped broadly in a hurry to get a pilot working ^[19].

Two columns sort the export. Expiry set or not, used in the last 90 days or not ^[18]. No expiry and unused is the revoke-now box, and nothing should break. Expiry set and unused, let it lapse. Expiry set and in use, put the renewal on a calendar. No expiry and in use is the box that costs a week, because someone has to identify the job behind the token before switching it off.

That box is also the reason to give the review to a named person. The export tells you who owns a credential ^[4]. Finding out which nightly build stops when it disappears is still a conversation with that owner. Self-hosted teams cannot start at all yet: GitHub says support for Enterprise Server is planned for upcoming releases ^[7].