99% of repository access tokens never expire, according to a developer risk report
RESEARCHBlueFlag Securityredteam/daily · 1 source
- Severity
- Medium
- Sources
- 1
What happened
BlueFlag Security's The State of Developer Risk 2026 report found that 99% of repository access tokens never expire. Developers, contractors, service accounts, bots and AI coding agents can therefore keep permissions that outlast their work, unless organisations run regular access reviews.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Review whether developer, contractor, service account and AI coding agent access to code repositories is still needed.
- Check for repository access tokens that never expire and consider setting expiry dates on them.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Help Net Security
Who and what is in it
Companies