Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Credential harvesting is the collection of authentication material from a developer’s computer or workflow so an attacker can act as the developer, a service, or a deployment system. The target is not limited to a typed password. API tokens, cloud credentials, package-publishing tokens, database connection strings, certificates, encryption keys, Git personal access tokens, SSH private keys, cached sessions, and CI/CD secrets can all become stepping stones to source code, infrastructure, data, or a software supply chain.
If a developer machine may be compromised, treat credentials that were accessible to it as potentially exposed. Identify their scope, revoke or rotate the likely affected ones, investigate account and workflow activity, and only then rebuild trust in the workstation and its automation.
What credential harvesting means for a developer
In security reporting, credential harvesting means obtaining secrets that authenticate to another system. An attacker may steal the material directly from a workstation, persuade a person to submit it to a fake sign-in page, extract it from a development project, or capture it from a connected build and deployment workflow. The result is an access problem: possession of a valid credential can remove the need to exploit the target service itself.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Developer environments are unusually valuable because one computer often has access to many services at once. A browser session may reach source hosting; a command-line tool may use a personal access token; an SSH key may open repositories or servers; cloud command-line credentials may control storage or deployment; and package-manager configuration may authorize publication. A single theft can therefore become code tampering, infrastructure changes, data exposure, or malicious package distribution.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
No single technique describes every incident. A historical CISA incident advisory describes credential dumping from LSASS memory and collection from password stores in that particular intrusion. That is evidence of those methods in one case, not proof that every infostealer or developer-focused attack searches those locations.
Which secrets attackers look for
“Credentials” includes any material that proves identity or authorizes an action. The same secret can be harmless in one context and highly privileged in another, so record its owner, permissions, expiration, and reachable systems during triage.
| Secret or credential | Where it is commonly used | What misuse could enable |
|---|---|---|
| Passwords, passkeys, and active browser sessions | Web accounts, source hosting, cloud consoles, dashboards | Account takeover or actions performed as the logged-in user |
| Personal access tokens and API keys | Git hosting, ticketing, registries, SaaS APIs | Repository reads or writes, API calls, automation changes |
| SSH private keys | Git over SSH, bastion hosts, production or build servers | Repository or server access if the key is trusted and usable |
| Cloud and service-account credentials | Cloud command-line tools, SDKs, infrastructure automation | Resource access, data theft, configuration or deployment changes |
| Package-ecosystem and publishing tokens | Package registries and release pipelines | Malicious or unauthorized package releases |
| Database passwords and connection strings | Local development, test environments, applications | Queries, data extraction, or modification within granted rights |
| Certificates, signing material, and encryption keys | Service identity, artifact signing, encrypted data | Impersonation, forged releases, or decryption where applicable |
| CI/CD secrets and workflow credentials | Build jobs, deployment workflows, cloud integrations | Build tampering, secret exfiltration, or production deployment |
GitHub’s authentication documentation describes password or passkey sign-in, personal access tokens, and SSH keys, with use through a browser, API, desktop application, or command line. Git credentials can be cached by credential helpers. SSH key pairs are generated locally, while the public key is added to the account; the private half must therefore be treated as sensitive even though the public half is intentionally shared.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Where secrets leak in a development workflow
Local configuration and environment files
Developers often keep connection strings, API keys, and service credentials in local configuration. A .env file, an infrastructure-as-code variable file, a shell history entry, or a tool’s configuration directory may contain a live value. A malware sample may target one or more of these locations, but no source establishes that every malware family searches all of them.
Source code, documentation, and Git history
Testing code sometimes embeds a real token or password. Documentation and example files can also contain working values copied from a local setup. Removing the line in a later commit does not erase earlier commits, forks, mirrors, backups, or clones. If a secret was ever valid, assume copies may exist and revoke it rather than relying on deletion.
CI/CD logs and workflow files
Build output can echo command-line arguments, environment variables, or error messages containing secrets. Workflow definitions can expose permissions, third-party actions, and deployment credentials. A compromised developer account may also be used to alter a workflow so that a future run sends secrets elsewhere.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Connected accounts and cached authentication
Credential helpers, browser profiles, desktop clients, cloud CLIs, package managers, and editor extensions may retain refresh tokens or other reusable material. An attacker who controls the endpoint can target an unlocked session even when the account has strong interactive authentication.
Free tools Windows power users keep installed
One-click scans. No signup required.
How a stolen credential becomes a larger compromise
The impact depends on permissions and trust relationships, not simply on the number of strings stolen. An attacker may begin with read access to a repository, discover deployment details, then use a second token to reach a cloud account. A write-capable source-hosting token can alter code or workflows. A package-publishing token can place a backdoored release where downstream builds consume it. Cloud or service-account credentials may expose storage, databases, signing systems, or production controls.
GitHub states that a credential compromise may lead to malicious code injection, which may enable data exfiltration. That chain explains why investigation must include more than the account whose token was found: inspect repository changes, workflow runs, package releases, deployment activity, and cloud audit trails that the identity could reach.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What to do when a developer credential may be stolen
Use the following sequence as a risk-based response. Adjust the scope to the evidence and your organization’s procedures; a personal-device suspicion does not automatically require every enterprise emergency measure.
- Declare the exposure and inventory access. Treat credentials accessible to the suspected machine or workflow as potentially compromised until assessed. For each item, record the owner, type, issuing service, permissions, expiration, last use, and systems it can reach. Prioritize code-hosting, cloud, package-publishing, deployment, and broadly privileged credentials.
- Revoke or rotate likely exposed credentials. GitHub’s incident guidance calls revocation the most immediate action for exposed or exploited credentials. Disable a token, remove a deploy key, invalidate a session, rotate a cloud secret, or replace an SSH key according to the issuing service. If a credential is used by automation, prepare its replacement before disabling it where safe.
- Preserve evidence before destructive cleanup. Isolate an affected system when the situation warrants it and preserve relevant logs, memory, and forensic images under your incident process. Avoid wiping the only copy of evidence before investigators can review it. CISA’s incident guidance recommends isolation and preservation for suspected compromise; apply those steps proportionally to the environment.
- Review identity and platform telemetry. Check account audit events, sign-in records, unexpected actors or IP addresses where available, token-use history, secret-scanning alerts, repository changes, and workflow runs. Availability depends on plan, role, permissions, enabled features, and whether logging was configured before the incident.
- Look for persistence and follow-on activity. Inspect new contributors, deploy keys, connected applications, organization or repository settings, workflow-file changes, cloud roles, unusual package releases, and unexpected deployments. Compare timestamps with the suspected machine’s activity and with credential last-use records.
- Investigate the endpoint and the workflow. Examine the developer machine for malware, unauthorized processes, altered startup items, suspicious browser or credential-helper activity, and unexpected files. Review CI/CD logs, runner configuration, cloud trails, and package activity for the same period. CISA’s 2026 developer supply-chain advisory specifically recommends reviewing affected developer machines, CI/CD logs, and cloud audit trails.
- Reissue narrowly scoped credentials. Create replacements with the smallest practical permissions, shorter lifetimes, and separate identities for development, testing, and production. Update dependent automation and verify successful runs after revocation. Broad emergency revocation can break workflows, so reserve organization-wide action for incidents that justify the disruption.
- Remove exposed copies and repair history. Delete secrets from current files, redact logs, and remediate repository history or forks where appropriate. This cleanup limits future exposure but never substitutes for revocation: a value may already have been copied or used.
How to investigate a suspected GitHub token or SSH-key theft
Start with the credential itself. Determine whether it was a classic personal access token, a fine-grained token, an SSH key, a deploy key, an application credential, or a workflow secret; then map its repositories, organizations, scopes, and expiry. Record the first and last known legitimate use before revocation if the platform exposes that information.
Next, examine audit-log events and alerts for unexpected actors, IP addresses, repository access, settings changes, workflow edits, and token-related activity. Search code and configuration for the value and review secret-scanning alerts. Inspect commits, pull requests, releases, tags, workflow runs, and package publications created during the exposure window. If the token could reach cloud or deployment systems, correlate the same period with cloud audit trails and deployment records.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Tool visibility is not universal: GitHub notes that audit-log access and other investigative features vary by plan, role, permissions, and prior setup. Absence of an event in an unavailable log is not proof that nothing happened. Preserve the timeline and document which evidence was and was not available.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Controls that reduce risk—and their boundaries
Controls address different stages of the problem. They complement one another rather than serving as interchangeable products or guarantees.
| Control | Primary stage | Strength | Boundary |
|---|---|---|---|
| Scoped, short-lived, revocable credentials | Prevention and containment | Limits reachable systems and the damage window | Cannot stop theft of a credential that is currently usable |
| Secret scanning | Detection | Finds recognized secret patterns in repositories and exposed locations | Does not prove an endpoint is clean and may not recognize every secret type |
| Push protection | Prevention at commit time | Can block some newly committed secrets before they enter a repository | Coverage varies; not all secret types are protected by default |
| Passkeys, two-factor authentication, and WebAuthn security keys | Interactive account sign-in | Strengthens authentication for supported accounts | Does not make local files, API tokens, SSH keys, or active sessions inaccessible to malware already running on the machine |
| Endpoint, workflow, and cloud monitoring | Detection and investigation | Connects machine evidence with account and infrastructure activity | Requires suitable telemetry, retention, and the ability to interpret it |
GitHub documents secret scanning and push protection as ways to detect existing secrets and block some new commits. Configure coverage for the secret types your organization uses, and keep real credentials out of source, documentation, examples, and logs. Repository controls cannot detect every endpoint theft path.
Passkeys, two-factor authentication, and security keys using WebAuthn can reduce account takeover through stolen passwords or phishing. They do not automatically protect arbitrary local tokens, SSH private keys, unlocked password stores, or active sessions from malware operating with access to the developer’s machine.
Developer supply-chain safeguards
CISA’s 2026 advisory on compromises affecting Nx Console and GitHub repositories highlights workflow and package risks. Monitor workflow files and contributor activity, review CI/CD and cloud audit trails, pin trusted package versions, and obtain packages from known trusted sources. These practices reduce opportunities for unauthorized workflow edits and dependency abuse, but they are ecosystem controls, not a guarantee against all credential harvesting.
- Separate development, test, and production identities and permissions.
- Require review for workflow, deployment, and package-release changes.
- Use environment-specific secrets instead of one token shared across projects.
- Keep secret values out of command output, build logs, screenshots, and documentation.
- Set expiration and rotation schedules, and test replacement credentials before an emergency.
- Record which automation depends on each credential so revocation does not become a blind outage.
Common mistakes after a suspected theft
- Deleting only the visible file: Git history, forks, backups, logs, and clones may still contain the value.
- Changing a password while leaving tokens active: API keys, SSH keys, sessions, and deploy credentials often have separate revocation controls.
- Assuming strong sign-in proves safety: WebAuthn protects an authentication step, not every secret already available on an infected endpoint.
- Revoking everything without dependency mapping: A sweeping action can break builds and deployments; prioritize high-impact credentials and prepare replacements.
- Treating missing telemetry as a clean bill of health: Logging gaps and plan limitations can hide activity, so document uncertainty and use endpoint and workflow evidence as well.
- Failing to inspect follow-on changes: An attacker may leave a new contributor, application, deploy key, workflow, or package release even after the original token is revoked.
How to judge whether a control fits
Evaluate a control against the credential and stage it covers. Ask what it protects, where it runs, which platform or plan features it requires, what operational disruption it introduces, and whether it prevents, detects, contains, or helps recover from an incident. A passkey is an account sign-in control; push protection is a repository commit control; a short-lived cloud token is a blast-radius control; and forensic review is an investigation control. None of these alone establishes that a developer machine is free of malware or that every secret has been protected.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
