← All keys & policies
Key·user
SSH key on a user account
Tier 1 · HighData
Why Tier 1
Acts as the user's Git access, with no scopes to narrow it. That includes pushing changes to workflow files, which then run with the repository's secrets.
An SSH key registered to the account authenticates git push, pull and clone over SSH without a web-based 2FA challenge.
Available on: Every setup. Source
Attack path
If an attacker obtains the private key (from an unencrypted disk or a leaked dotfile), they can push to every repository the account can write to, indefinitely, since SSH Git authentication is not gated by the session 2FA prompts the web UI uses.
Mitigations
- Always set a passphrase on SSH private keys
- Rotate or revoke keys found on shared or unmanaged machines
- Use SSH certificates with a short validity where possible
Detect
Alert on public_key.create, public_key.update, git.push in the audit log.