99% of repository access tokens never expire, according to a developer risk report
RESEARCHBlueFlag Securityredteam/daily · 1 source
- Severity
- Medium
- Sources
- 1
What happened
BlueFlag Security's The State of Developer Risk 2026 report states that 99% of repository access tokens never expire. The report says that without access reviews, accounts across code repositories, review systems, build pipelines and connected applications can keep the ability to copy or modify company code after a engagement ends. Defenders should audit non-expiring tokens and standing permissions for developers, contractors, service accounts, bots and AI coding agents. The article gives no CVEs or specific product versions.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Review whether developer, contractor, service account and AI coding agent access to code repositories is still needed.
- Check for repository access tokens that never expire and consider setting expiry dates on them.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Help Net Security
Who and what is in it
Companies