GitHub Enterprise now provides a built‑in way for enterprise owners to pull a complete list of every credential that can access the organization—SSH keys, classic and fine‑grained personal access tokens, OAuth app tokens, and GitHub App tokens—either through a CSV download in the UI or via a paginated REST API. This single‑pane view is intended to speed up security investigations and give teams a concrete data set for risk assessment.
What Changed: Credential Inventory Export
The new feature appears under Settings → Authentication Security → Credentials as an “Export CSV” button. Selecting it produces a CSV file that can be filtered by user, app, credential type, or organization. The same data set is also available programmatically through newly added REST endpoints that return the inventory in pages, allowing custom reporting or automation pipelines.
Why It Matters to Engineers and Security Teams
Having an exhaustive inventory lets security engineers quickly gauge the exposure surface after a breach or suspected token compromise. The export includes metadata such as owner, scopes, creation and expiration dates, last‑used timestamps, and the target repositories or organizations, which can be cross‑referenced with audit‑log entries for deeper insight. For DevOps and platform engineers, the ability to script regular pulls means credential hygiene can be baked into CI/CD compliance checks.
Operational and Architectural Considerations
- Permission model: Only enterprise owners and members granted the fine‑grained View enterprise credentials permission can request the export, so role assignments must be verified before relying on the data.
- Data handling: The CSV contains sensitive token identifiers and usage details; organizations should treat the file as secret material, store it securely, and enforce retention policies.
- Automation: The paginated API enables integration with existing security tooling (e.g., SIEM, secret‑scanning services). Scripts should handle pagination and respect rate limits.
- Future compatibility: The feature is live for GitHub Enterprise Cloud and slated for upcoming Enterprise Server releases, so mixed‑environment deployments should plan for consistent access across both platforms.
Related CloudNinjas coverage: security.
What This Means For Practitioners
Start by confirming that the appropriate View enterprise credentials permission is assigned to the accounts that will run exports. Schedule periodic CSV downloads or API pulls and feed the results into your credential‑risk dashboards. Use the metadata to identify stale or over‑privileged tokens and retire them as part of regular hygiene cycles. Finally, monitor GitHub’s release notes for the forthcoming Enterprise Server support to ensure your on‑premises fleets can adopt the same workflow.