99% of repository access tokens never expire

Nearly all repository access tokens never expire, according to BlueFlag Security’s State of Developer Risk 2026 report, reported by Help Net Security. The report warns that developers, automated tools and AI coding agents hold permissions that can outlast the work they were granted for, leaving accounts able to copy or change company code after the work ends.