← All keys & policies
Key·repository
Deploy key with write access
Tier 1 · HighData
Why Tier 1
Pushes to its repository like Contents: write. A key carries no scopes, so nothing in it stops pushes to workflow files either, and it has no user, no 2FA and no expiry.
An SSH key attached to one repository instead of a user. Read-only by default; write access is opt-in when the key is added.
Available on: Every setup. Source
Attack path
A write deploy key is a Git credential with no user, no 2FA and no expiry. It survives the departure of whoever created it and does not show up in member reviews. Stolen from a server or CI config, it pushes to that repository until someone deletes it.
Mitigations
- Prefer read-only deploy keys, or a GitHub App with Contents: write
- Delete keys nobody can name an owner for
- Turn off deploy keys at the organization level if nothing needs them
Detect
Alert on public_key.create, public_key.update, git.push in the audit log.