GitHub App private key (.pem)
Why Tier 0
Mints installation tokens for every installation of the App, so it carries the strongest permission any installation was given. For an App with organization Administration or Members permissions that is Tier 0.
The App's signing key, used to create JWTs and mint installation access tokens for every organization and repository where the App is installed.
Available on: Every setup. Source
Attack path
A leaked private key lets an attacker mint installation tokens for every installation of the App, instantly inheriting whatever permissions each installation granted. Since one App is often installed organization-wide, this is frequently the highest-leverage credential in an organization's supply chain.
Mitigations
- Rotate keys regularly
- Store it in a secrets manager, never in a repository or CI logs
- Give the App the minimum permissions
- Install on selected repositories, not all
Detect
Alert on integration.manager_added, org.integration_manager_added, integration.transfer in the audit log (the closest events GitHub logs).