stepsecurity.ioarticleFind Unused, Stale, and OIDC-Replaceable GitHub Actions Secrets Across Your GitHub Organization
StepSecurity describes a new Repository Secrets feature in its Actions Secret dashboard that inventories GitHub Actions secrets across an org and classifies each as Active, Stale (unused workflow for 90+ days), or Unused, while flagging which secrets could be eliminated by switching to OIDC (e.g. AWS, Azure, GCP federation or npm/PyPI trusted publishing). It ties the problem to real incidents - the GhostAction campaign exfiltrated 3,000+ secrets and Megalodon targeted 5,500 public repos - arguing that unused, long-lived credentials are attack surface attackers actively harvest regardless of whether they are load-bearing.
TL;DR StepSecurity's Actions Secret dashboard now flags unused, stale, and OIDC-replaceable GitHub Actions secrets org-wide, aimed at shrinking the credential attack surface exploited by campaigns like GhostAction and Megalodon.
Organisations named here
- Shai-Hulud
Technologies named here
- GitHub Actions
- StepSecurity Actions Secret
- StepSecurity Action Advisor
- npm
- aws-actions/configure-aws-credentials
- PyPI
- google-github-actions/auth
- AWS
- azure/login
- Harden-Runner
- OpenID Connect
- Azure
- StepSecurity
Techniques named here
- Secret exfiltration via malicious committed workflows
- Stolen token abuse for package publishing
- Secret reference detection
Threat actors named here
- GhostAction
- Megalodon
- Shai-Hulud
Related in DevSecOps
jfrog.comarticleJFrog: The Governance Gap Between Your Policy and Your Pipeline
stepsecurity.ioarticleDev Machine Guard Now Supports Windows - StepSecurity
socket.devwriteupSocket: TanStack npm Packages Compromised
securitylab.github.comadvisory