{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/github-deploy-key-offboarding-scope-expiry/", "item": { "id": "https://update.dsesecurity.com/updates/github-deploy-key-offboarding-scope-expiry/", "slug": "github-deploy-key-offboarding-scope-expiry", "url": "https://update.dsesecurity.com/updates/github-deploy-key-offboarding-scope-expiry/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/github-deploy-key-offboarding-scope-expiry.md", "json": "https://update.dsesecurity.com/api/v1/posts/github-deploy-key-offboarding-scope-expiry/" }, "title": "Retire GitHub deploy keys separately from the employee account that created them", "summary": "Repository-attached deployment credentials can remain active after their creator no longer has access.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:14:32+00:00", "modified_at": "2026-10-20T18:34:31+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 264, "potentially_affected": "This concerns repository deploy keys, not personal SSH keys or GitHub App installation tokens. The appropriate automation identity depends on the actual integration and required permissions.", "dse_recommendation": "DSE recommends including deploy keys in both service retirement and employee offboarding reviews.", "primary_source": { "name": "GitHub — Managing deploy keys", "url": "https://docs.github.com/en/authentication/connecting-to-github-with-ssh/managing-deploy-keys", "published_on": null, "authority": "docs.github.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Repository-attached deployment credentials can remain active after their creator no longer has access.

\n

Source facts

\n

A GitHub deploy key grants SSH access to one repository and is attached to the repository rather than a personal account. Deploy keys are read-only by default, can be given write access and have no expiry date. GitHub states that removing the creating user from the repository does not deactivate the key. Multiple repositories require separate deploy keys.

\n

Source: GitHub — Managing deploy keys.

\n

Applicability

\n

This concerns repository deploy keys, not personal SSH keys or GitHub App installation tokens. The appropriate automation identity depends on the actual integration and required permissions.

\n

DSE recommendation

\n

DSE recommends including deploy keys in both service retirement and employee offboarding reviews. Record the server, repository, purpose, permission level and current service owner for each key. Reassess any write grant explicitly and protect the server-side private key. Consider the documented GitHub App alternative when the integration needs managed permissions across repositories rather than accumulating unidentified deployment credentials. Include the key’s repository attachment in the offboarding handoff so removal of a person is not accepted as credential retirement evidence. Assign a current service owner and a separate revocation check to each automation that still depends on a deploy key.

\n

Verification

\n

Proposed verification: inspect repository deploy-key inventory and compare it with the servers that still use each credential. In an approved test integration, verify the intended read or write scope and confirm revocation stops access. Retain public identifiers and outcomes only; never copy private keys into tickets or publication evidence.

\n

Official reference

\n

GitHub — Managing deploy keys. Reviewed October 20, 2026.

", "content_text": "Repository-attached deployment credentials can remain active after their creator no longer has access.\nSource facts\nA GitHub deploy key grants SSH access to one repository and is attached to the repository rather than a personal account. Deploy keys are read-only by default, can be given write access and have no expiry date. GitHub states that removing the creating user from the repository does not deactivate the key. Multiple repositories require separate deploy keys.\nSource: GitHub — Managing deploy keys.\nApplicability\nThis concerns repository deploy keys, not personal SSH keys or GitHub App installation tokens. The appropriate automation identity depends on the actual integration and required permissions.\nDSE recommendation\nDSE recommends including deploy keys in both service retirement and employee offboarding reviews. Record the server, repository, purpose, permission level and current service owner for each key. Reassess any write grant explicitly and protect the server-side private key. Consider the documented GitHub App alternative when the integration needs managed permissions across repositories rather than accumulating unidentified deployment credentials. Include the key’s repository attachment in the offboarding handoff so removal of a person is not accepted as credential retirement evidence. Assign a current service owner and a separate revocation check to each automation that still depends on a deploy key.\nVerification\nProposed verification: inspect repository deploy-key inventory and compare it with the servers that still use each credential. In an approved test integration, verify the intended read or write scope and confirm revocation stops access. Retain public identifiers and outcomes only; never copy private keys into tickets or publication evidence.\nOfficial reference\nGitHub — Managing deploy keys. Reviewed October 20, 2026.", "content_markdown": "Repository-attached deployment credentials can remain active after their creator no longer has access.\n\n## Source facts\n\nA GitHub deploy key grants SSH access to one repository and is attached to the repository rather than a personal account. Deploy keys are read-only by default, can be given write access and have no expiry date. GitHub states that removing the creating user from the repository does not deactivate the key. Multiple repositories require separate deploy keys.\n\nSource: [GitHub — Managing deploy keys](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/managing-deploy-keys).\n\n## Applicability\n\nThis concerns repository deploy keys, not personal SSH keys or GitHub App installation tokens. The appropriate automation identity depends on the actual integration and required permissions.\n\n## DSE recommendation\n\nDSE recommends including deploy keys in both service retirement and employee offboarding reviews. Record the server, repository, purpose, permission level and current service owner for each key. Reassess any write grant explicitly and protect the server-side private key. Consider the documented GitHub App alternative when the integration needs managed permissions across repositories rather than accumulating unidentified deployment credentials. Include the key’s repository attachment in the offboarding handoff so removal of a person is not accepted as credential retirement evidence. Assign a current service owner and a separate revocation check to each automation that still depends on a deploy key.\n\n## Verification\n\nProposed verification: inspect repository deploy-key inventory and compare it with the servers that still use each credential. In an approved test integration, verify the intended read or write scope and confirm revocation stops access. Retain public identifiers and outcomes only; never copy private keys into tickets or publication evidence.\n\n## Official reference\n\n[GitHub — Managing deploy keys](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/managing-deploy-keys). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/github-deploy-key-offboarding-scope-expiry/", "url": "https://update.dsesecurity.com/updates/github-deploy-key-offboarding-scope-expiry/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/github-deploy-key-offboarding-scope-expiry/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Retire GitHub deploy keys separately from the employee account that created them", "item": "https://update.dsesecurity.com/updates/github-deploy-key-offboarding-scope-expiry/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/github-deploy-key-offboarding-scope-expiry/#article", "identifier": "https://update.dsesecurity.com/updates/github-deploy-key-offboarding-scope-expiry/", "url": "https://update.dsesecurity.com/updates/github-deploy-key-offboarding-scope-expiry/", "headline": "Retire GitHub deploy keys separately from the employee account that created them", "description": "Repository-attached deployment credentials can remain active after their creator no longer has access.", "abstract": "Repository-attached deployment credentials can remain active after their creator no longer has access.", "articleBody": "Repository-attached deployment credentials can remain active after their creator no longer has access.\nSource facts\nA GitHub deploy key grants SSH access to one repository and is attached to the repository rather than a personal account. Deploy keys are read-only by default, can be given write access and have no expiry date. GitHub states that removing the creating user from the repository does not deactivate the key. Multiple repositories require separate deploy keys.\nSource: GitHub — Managing deploy keys.\nApplicability\nThis concerns repository deploy keys, not personal SSH keys or GitHub App installation tokens. The appropriate automation identity depends on the actual integration and required permissions.\nDSE recommendation\nDSE recommends including deploy keys in both service retirement and employee offboarding reviews. Record the server, repository, purpose, permission level and current service owner for each key. Reassess any write grant explicitly and protect the server-side private key. Consider the documented GitHub App alternative when the integration needs managed permissions across repositories rather than accumulating unidentified deployment credentials. Include the key’s repository attachment in the offboarding handoff so removal of a person is not accepted as credential retirement evidence. Assign a current service owner and a separate revocation check to each automation that still depends on a deploy key.\nVerification\nProposed verification: inspect repository deploy-key inventory and compare it with the servers that still use each credential. In an approved test integration, verify the intended read or write scope and confirm revocation stops access. Retain public identifiers and outcomes only; never copy private keys into tickets or publication evidence.\nOfficial reference\nGitHub — Managing deploy keys. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:14:32+00:00", "dateModified": "2026-10-20T18:34:31+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/github-deploy-key-offboarding-scope-expiry/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/github-deploy-key-offboarding-scope-expiry/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Retire GitHub deploy keys separately from the employee account that created them" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 264, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "GitHub — Managing deploy keys", "url": "https://docs.github.com/en/authentication/connecting-to-github-with-ssh/managing-deploy-keys" } } ] } }