# Retire GitHub deploy keys separately from the employee account that created them

> Repository-attached deployment credentials can remain active after their creator no longer has access.

- Canonical URL: https://update.dsesecurity.com/updates/github-deploy-key-offboarding-scope-expiry/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:14:32+00:00
- Modified: 2026-10-20T18:34:31+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

Repository-attached deployment credentials can remain active after their creator no longer has access.

## Potentially affected

This concerns repository deploy keys, not personal SSH keys or GitHub App installation tokens. The appropriate automation identity depends on the actual integration and required permissions.

## DSE recommendation

DSE recommends including deploy keys in both service retirement and employee offboarding reviews.

## Article

Repository-attached deployment credentials can remain active after their creator no longer has access.

## Source facts

A GitHub deploy key grants SSH access to one repository and is attached to the repository rather than a personal account. Deploy keys are read-only by default, can be given write access and have no expiry date. GitHub states that removing the creating user from the repository does not deactivate the key. Multiple repositories require separate deploy keys.

Source: [GitHub — Managing deploy keys](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/managing-deploy-keys).

## Applicability

This concerns repository deploy keys, not personal SSH keys or GitHub App installation tokens. The appropriate automation identity depends on the actual integration and required permissions.

## DSE recommendation

DSE recommends including deploy keys in both service retirement and employee offboarding reviews. Record the server, repository, purpose, permission level and current service owner for each key. Reassess any write grant explicitly and protect the server-side private key. Consider the documented GitHub App alternative when the integration needs managed permissions across repositories rather than accumulating unidentified deployment credentials. Include the key’s repository attachment in the offboarding handoff so removal of a person is not accepted as credential retirement evidence. Assign a current service owner and a separate revocation check to each automation that still depends on a deploy key.

## Verification

Proposed verification: inspect repository deploy-key inventory and compare it with the servers that still use each credential. In an approved test integration, verify the intended read or write scope and confirm revocation stops access. Retain public identifiers and outcomes only; never copy private keys into tickets or publication evidence.

## Official reference

[GitHub — Managing deploy keys](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/managing-deploy-keys). Reviewed October 20, 2026.

## Primary reference

- Name: GitHub — Managing deploy keys
- Authority: docs.github.com
- URL: https://docs.github.com/en/authentication/connecting-to-github-with-ssh/managing-deploy-keys
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Retire GitHub deploy keys separately from the employee account that created them,” DSE Security, https://update.dsesecurity.com/updates/github-deploy-key-offboarding-scope-expiry/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.