← All keys & policies
Key·app
GitHub App or OAuth App client secret
Tier 2 · MediumData
Why Tier 2
Not a credential on its own: it exchanges authorization codes and refresh tokens for user access tokens. Stolen together with stored refresh tokens, it turns them into live tokens for every user of the App, at those users' access.
The secret an App uses with its client ID to get user access tokens and refresh them.
Available on: Every setup. Source
Attack path
Apps often keep the client secret next to the refresh tokens of their users. Whoever gets both can mint user access tokens for each of those users until the secret is rotated and the tokens revoked.
Mitigations
- Keep client secrets and refresh tokens in a secrets manager, apart from each other
- Rotate the client secret when the App's servers are compromised
Detect
Alert on oauth_application.generate_client_secret, oauth_application.reset_secret, integration.remove_client_secret in the audit log (the closest events GitHub logs).