← All keys & policies
Key·repository
Codespaces token
Tier 2 · MediumData
Why Tier 2
Read and write on the codespace's repository when its owner has write access, plus any other repositories the codespace was authorized for. Data plane, and it expires on its own.
The GitHub token a codespace gets each time it is created or restarted. Its scope follows the owner's access to the repository.
Available on: Free, Team, Enterprise Cloud, EMU. Source
Attack path
Code running in a codespace, such as a malicious dependency or a dev container script, can read the token and push to the repository as the developer while it is valid.
Mitigations
- Only authorize a codespace for the other repositories it needs
- Treat dev container configuration from untrusted branches as code that runs with this token
Detect
Alert on codespaces.create, codespaces.connect, codespaces.allow_permissions in the audit log.