GitHub Enterprise Token
Description
General
- Documentation: https://docs.github.com/en/rest/overview/other-authentication-methods#via-oauth-and-personal-access-tokens
- Summary: GitHub accounts can be controlled programmatically (create/delete repo, create issues, push commits, ...). It is a pretty sensitive leak when the token has a lot of permissions configured. This detector aims at detecting token/host couple used to access resources hosted by GitHub Enterprise Server instances until version 3.1.22.
- IPs allowlist: As of the time of writing this documentation, this feature is not yet supported.
- Scopes: Scopes and permissions of the token can be chosen when creating a GitHub personal access token see GitHub's documentation.
Revoke the secret
Tokens can be revoked from the access tokens panel under developer settings
by clicking on the delete button. In the case of an on-premise installation, the previously mentioned URL needs to be modified.
Check for suspicious activity
Based on available information, there is no way to check the last calls made with an API token. But GitHub offers the possibility to review some security logs. This is better than nothing, but won't tell if someone was able to access private repositories for example.
Details for Github enterprise token
-
Family: token
-
Category: version_control_platform
-
Company: GitHub
-
High recall: False
-
Validity check available: True
-
Analyzer available: False
-
On-premise instances exist: False
-
Only valid secrets raise an alert: True
-
Minimum number of matches: 2
-
Occurrences found for one million commits: 10.72
-
Prefixed: False
-
PreValidators:
- type: FilenameBanlistPreValidator
banlist_extensions:
- ^csv$
- ^ebuild$
- ^rst$
- ^txt$
- ^xcuserstate$
banlist_filenames:
- Cartfile\.resolved
- Portfile$
- \.gitrepo$
- ^m$
- _config\.yml$
- arm64
- build-log
- dependencies
- deps
- kernel
- monitor\.log
- ngsw\.json
- packages
- release[_-]notes
- search_plus_index\.json
- vendor
- vendor\.conf
- x86
check_binaries: false
include_default_banlist_extensions: true
ban_markup: false
- type: ContentWhitelistPreValidator
patterns:
- github\.
- type: ContentWhitelistPreValidator
patterns:
- '[0-9a-f]{40}'
- type: BanMinifiedPreValidator
threshold_minified: 0.6