Credential harvesting is the collection of authentication material from a developer’s computer or connected workflow. The target is not limited to a password. API tokens, cloud credentials, package-publishing tokens, certificates, database connection strings, Git access tokens, SSH private keys, and active sessions can all let an intruder reach systems beyond the workstation.
That makes a compromised development machine an access problem. One stolen secret can enable repository changes, cloud actions, malicious package releases, deployment tampering, or data theft. Treat suspicious exposure as a potential account and supply-chain incident, not as a file-cleanup task.
As an Amazon Associate I earn from qualifying purchases.
What credential harvesting means in a developer environment
Credential harvesting is the deliberate acquisition of secrets that authenticate a person, automation account, service, or machine. Attackers may obtain them from local files, application data, memory, configuration, source control, or connected services. The exact technique varies by malware and intrusion; no single method explains every theft.
Recommended Free Tools
GitHub’s authentication documentation describes several ways a developer can authenticate, including password or passkey sign-in, personal access tokens, and SSH keys. Those credentials may be used through a browser, API, desktop application, or command line. A local credential helper can cache Git credentials, while an SSH key pair is generated on the developer’s machine and the public key is added to an account.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
In a real incident, an attacker may combine several sources. For example, a token found in a local configuration file can identify an organization, while an SSH key or cloud credential provides a second route into code or infrastructure. The presence of one stolen secret does not prove that every other secret was copied, but it is enough to justify a wider assessment.
Which developer credentials are valuable
| Credential or secret | Typical authority | Why theft matters |
|---|---|---|
| Personal access token | Repository, API, or organization actions allowed by its scopes | Can permit code reads or writes, issue changes, workflow actions, or account administration depending on permissions. |
| SSH private key | Authentication to Git hosting, servers, or automation targets | May provide access without the account password and can be difficult to notice if the key remains registered. |
| Cloud access key or service-account token | Cloud APIs, storage, compute, deployment, or data services | Can turn a workstation compromise into infrastructure changes or data exposure. |
| Package-registry token | Download or publish rights for packages | A publishing-capable token can support a malicious release that reaches downstream builds. |
| Database password or connection string | Direct database or application access | May expose production or development data and can be reused by other systems. |
| Certificate, encryption key, or signing key | Identity, encryption, signing, or trust functions | Compromise can undermine verification or confidentiality even when no password is involved. |
| CI/CD or deployment secret | Build runners, deployment jobs, or release systems | Can enable altered builds, unauthorized deployments, or access to additional secrets. |
GitHub defines secrets broadly to include API keys and tokens, database passwords and connection strings, cloud credentials, service-account tokens, certificates, and encryption keys. A secret’s risk depends on its scope, privileges, lifetime, and the systems reachable with it.
Where secrets become exposed
Local development configuration
Developers often keep environment variables, .env files, infrastructure-as-code settings, test credentials, and local configuration beside a project. GitHub specifically identifies credentials accidentally added during local testing and secrets in .env or infrastructure files as common leakage paths. A malware family may inspect some of these locations, but no source establishes that every infostealer searches all of them.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Source code and Git history
A secret removed from the current working tree can remain in earlier commits, tags, forks, mirrors, or backups. Anyone who already copied the value may continue using it. Deleting the file therefore does not invalidate the credential; revocation and replacement are required.
CI/CD logs and workflow files
Build output can accidentally echo environment variables, command arguments, or connection strings. Workflow definitions can also expose how secrets are passed to jobs. In 2026, CISA described a Megalodon campaign that injected GitHub Actions workflows to harvest CI/CD secrets, cloud credentials, and tokens. That advisory recommends reviewing workflow files, run history, and cloud trails when the developer ecosystem may be affected.
Connected accounts and automation
A browser session, desktop client, deploy key, app authorization, or pipeline identity may remain valid after a local file is deleted. Investigators should look for unexpected contributors, deploy keys, applications, workflow changes, and package releases because follow-on access may use a different credential than the one first discovered.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How a stolen secret becomes a larger compromise
- Collection: Malware or an intruder obtains a token, key, password, certificate, or session from a developer machine or workflow.
- Validation: The actor tests whether the credential is still active and identifies its scopes, owner, and reachable services.
- Expansion: Repository, cloud, package, database, or CI/CD access reveals additional secrets or permits changes to automation.
- Impact: The actor can alter code, inject a build change, publish a malicious package, deploy unauthorized resources, or copy data. GitHub notes that credential compromise may lead to malicious code injection, which may enable data exfiltration.
Privileges determine the blast radius. A read-only token limited to one repository is materially different from a broadly scoped organization, cloud, or publishing credential. A short-lived, narrowly scoped token also leaves a smaller misuse window than a long-lived key with administrative rights.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →What to do when a token or key may be stolen
Assume a potentially exposed credential is compromised until you can establish otherwise. Avoid wiping the machine or deleting evidence before deciding what your organization needs to preserve. The sequence below combines credential containment with investigation.
- Identify the credential. Record its type, owner, scopes, expiration, associated account, and systems it can reach. Include copies in local files, repositories, workflow variables, logs, and backup locations.
- Contain the highest-risk access first. Revoke or rotate credentials that can modify source code, publish packages, deploy infrastructure, administer cloud resources, or read sensitive data. For a GitHub token, revocation is the immediate action GitHub recommends for exposed or exploited credentials.
- Preserve and review evidence. Save relevant endpoint, repository, workflow, and cloud records according to your incident process. CISA guidance for suspected compromise includes isolating affected systems and preserving logs, memory, and forensic images when that level of response is appropriate.
- Check platform activity. Review audit-log events, unexpected actors or IP addresses where available, secret-scanning alerts, repository changes, workflow files and runs, deploy keys, app authorizations, and package releases. Availability of particular events and tools depends on plan, role, permissions, and whether the feature was enabled beforehand.
- Look for follow-on persistence. Search for unfamiliar contributors, new keys, newly authorized applications, altered workflows, unexpected build artifacts, or releases that do not match your change process.
- Rotate dependent credentials. If the exposed secret could read another secret or access a deployment system, rotate those downstream credentials as well. Reissue replacements with the smallest practical scope and a defined expiration.
- Restore automation deliberately. Test builds, deployments, package publishing, and scheduled jobs after rotation. Organization-wide emergency revocation can break automations, so GitHub advises reserving disruptive actions for major incidents and applying them to the affected scope.
- Remove exposed copies. Delete leaked values from current files, logs, documentation, and configuration, and clean repository history where appropriate. History remediation reduces future exposure but never substitutes for revocation.
Investigating a suspected GitHub token or SSH-key compromise
Token-specific checks
Start with the token’s owner, scopes, creation and use records, and the repositories or organizations it could reach. Compare audit events with the developer’s normal activity, looking for unfamiliar actors, locations, repository changes, workflow edits, or API actions. Then inspect secret-scanning alerts and code or configuration where the token may have been exposed.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
SSH-key-specific checks
Determine whether the private key was stored on the affected machine, whether its passphrase was available to local software, and where the corresponding public key is registered. Remove the key from accounts and automation that no longer require it, issue a replacement pair, and review activity performed through the key’s account.
When endpoint evidence matters
Endpoint investigation is important when malware may still be present or when several credentials were accessible. CISA’s historical incident guidance describes credential dumping from LSASS memory and gathering credentials from password stores in a specific intrusion. That example should not be generalized into a claim that every developer-focused attack uses those techniques. Use the evidence from the affected operating system, applications, and timeline to choose the appropriate forensic depth.
Controls that reduce risk—and what they cannot do
| Control | Primary stage covered | Limits to understand |
|---|---|---|
| Narrow scopes, short lifetimes, and rapid revocation | Containment and recovery | Reduces reachable systems and misuse time but does not stop malware from copying a credential while it is valid. |
| Secret scanning | Detection of exposed values in repositories and related content | Finds supported patterns after exposure; it is not endpoint-malware detection. |
| Push protection | Prevention of some new secret commits | Not every secret type is protected by default; coverage and configuration matter, and existing copies may remain elsewhere. |
| Passkeys, two-factor authentication, and WebAuthn security keys | Interactive account sign-in | Strengthen supported sign-ins but do not make local files, API tokens, SSH keys, or active sessions inaccessible to malware already running on a machine. |
| Machine forensics and isolation | Endpoint investigation and containment | Can preserve evidence and limit ongoing access, but the required depth depends on the device, evidence, and incident scope. |
| Workflow and cloud audit review | Detection of misuse and follow-on activity | Records vary by platform, plan, role, permissions, and prior setup; absence of an event is not proof that no theft occurred. |
GitHub documents secret scanning and push protection as complementary controls: one helps discover exposed credentials, while the other blocks some newly committed secrets. Configure coverage for the secret types your organization uses, and still treat endpoint compromise as a separate problem.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Hardening the developer workflow
- Keep real credentials out of source code, documentation, examples, and infrastructure files; use managed injection mechanisms appropriate to the deployment system.
- Give each person, job, and service its own identity so a rotation does not require changing unrelated systems.
- Prefer credentials that are narrowly scoped, revocable, and time-limited. Separate read, write, publish, deploy, and administrative permissions.
- Monitor workflow files and contributor activity, review CI/CD and cloud audit trails, pin trusted package versions, and obtain packages from known trusted sources. CISA presents these measures in the context of developer supply-chain compromise, not as a guarantee against all credential theft.
- Enable strong sign-in methods, including passkeys, two-factor authentication, or WebAuthn security keys where supported. These protect account authentication while leaving local secret storage and active sessions as separate risks.
- Make secret scanning and push protection part of repository governance, then define who receives alerts and how quickly credentials are revoked.
- Document rotation dependencies before an emergency. Know which jobs, runners, deployment systems, package registries, and cloud resources will fail when a credential is revoked.
Common mistakes after a suspected leak
- Deleting only the visible file: The value may remain in Git history, forks, backups, logs, or an attacker’s copy.
- Rotating a password but not tokens and keys: Developer access often uses several independent credential types.
- Relying on a clean scan: Scanning coverage is limited and does not establish that a workstation is free of malware.
- Revoking everything without a plan: Broad emergency action can interrupt production and automation; prioritize high-impact credentials and test replacements.
- Ignoring CI/CD and cloud trails: A token may have been used to alter workflows or obtain additional secrets even when repository files look unchanged.
- Assuming stronger sign-in solves local theft: Passkeys and security keys help prevent account takeover through sign-in, but they do not erase an already copied API token or SSH private key.
A practical decision framework
Choose controls by asking four questions: Which credential is at risk? Where could it have been exposed? What can it reach? and Which stage needs help—prevention, detection, containment, or recovery? A push-protection rule is appropriate for a commit-time leak; an audit-log review is appropriate for suspected use; endpoint isolation is appropriate when malware may remain active; and revocation is appropriate whenever a credential’s exposure is plausible.
No single control covers every stage. Effective response combines credential-specific containment with repository, workflow, cloud, and machine investigation. The goal is not merely to remove a string from a file, but to stop unauthorized access, determine what was used, and issue safer credentials for the work that must continue.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
