99% of repository access tokens never expire
never expire disclosed that a credential was leaked, exposing a trust relationship that could have been abused.
never expire disclosed that a credential was leaked, exposing a trust relationship that could have been abused.
Developers , automated tools and AI coding agents hold permissions that can outlast the work they were granted for.
Without access reviews, organizations can leave accounts able to copy or change company code after the work ends, according to BlueFlag Security’s The State of Developer Risk 2026 report.
Four in five organizations had developer identities that had been inactive for more than 90 days but retained administrator permissions.
Anyone connected to never expire through the compromised trust relationship is potentially affected, not just never expire itself.
Software development spans code repositories, review systems, build pipelines and connected applications.
Developers, contractors, service accounts, bots and AI coding agents use these systems with permissions that require ongoing oversight.
A leaked key doesn't need an exploit to be dangerous -- it just needs to still work before someone notices and revokes it.
Access can accumulate when developers join projects, change teams or take on administrative tasks.
Of the developers holding the most unused permissions, 88% could access repositories their organizations classified as business-critical, including those supporting production services, payment systems and regulated workloads.
The trust mechanism involved here is an OAuth or access token, which is what let access move between otherwise unrelated systems.
Permissions granted for a contract or assignment may remain after the work ends.
The average developer had not used 61% of their granted permissions.
never expire says the credential has been revoked, and no exploitation has been confirmed so far.
Service accounts, bots, connected applications and access tokens allow tools to retrieve code, run builds and deploy software.
Autonomous agents operate as separate identities and can write, review and merge code without a human approving each action.
If you have any integration or dependency involving never expire, rotate any credentials shared with it as a precaution, even without confirmation you were directly affected.
Your own credential inventory is worth auditing for keys or tokens with broader access than they actually need -- the same blast-radius problem applies to anything your own organization leaks.
Administrator permissions were held by 68% of the developer and service account identities that agents operated under, and 81% lacked behavioral monitoring.
What happened
never expire disclosed that a credential was leaked, exposing a trust relationship that could have been abused.
Developers , automated tools and AI coding agents hold permissions that can outlast the work they were granted for.
Without access reviews, organizations can leave accounts able to copy or change company code after the work ends, according to BlueFlag Security’s The State of Developer Risk 2026 report.
What changed
Four in five organizations had developer identities that had been inactive for more than 90 days but retained administrator permissions.
Who is affected
Anyone connected to never expire through the compromised trust relationship is potentially affected, not just never expire itself.
Software development spans code repositories, review systems, build pipelines and connected applications.
Developers, contractors, service accounts, bots and AI coding agents use these systems with permissions that require ongoing oversight.
Why it matters
A leaked key doesn't need an exploit to be dangerous -- it just needs to still work before someone notices and revokes it.
Access can accumulate when developers join projects, change teams or take on administrative tasks.
Of the developers holding the most unused permissions, 88% could access repositories their organizations classified as business-critical, including those supporting production services, payment systems and regulated workloads.
Technical details
The trust mechanism involved here is an OAuth or access token, which is what let access move between otherwise unrelated systems.
Permissions granted for a contract or assignment may remain after the work ends.
The average developer had not used 61% of their granted permissions.
Response
never expire says the credential has been revoked, and no exploitation has been confirmed so far.
Service accounts, bots, connected applications and access tokens allow tools to retrieve code, run builds and deploy software.
Autonomous agents operate as separate identities and can write, review and merge code without a human approving each action.
What security teams should do
If you have any integration or dependency involving never expire, rotate any credentials shared with it as a precaution, even without confirmation you were directly affected.
Your own credential inventory is worth auditing for keys or tokens with broader access than they actually need -- the same blast-radius problem applies to anything your own organization leaks.
Administrator permissions were held by 68% of the developer and service account identities that agents operated under, and 81% lacked behavioral monitoring.