Researchers discovered 474 leaked GitHub App private keys still active, including one committed to the CDC's official repository in April 2025 that provided write access to CDC systems for 17 months. The compromised key granted potential code execution capabilities in the CDC's Azure environment and was revoked on September 18.