Stale (inactive) VCS committer identities

stale_vcs_identities

Severity

low

Remediation Complexity

medium

Remediation Risk

low

Remediation Effort

low

Family

SCM

Description

Are there committer identities that have not been active for a long time?

A dormant-but-still-authorised account is a standing risk: nobody is watching it, yet it retains its access, so a leaked credential or a forgotten token becomes a quiet foothold. SPVS V1.1.4 requires inactive users to be reviewed and removed periodically. The check flags committer identities whose most recent commit is older than a configurable threshold (default 60 days).

Activity is judged from commit-author recency through the SCM-neutral model, so the check works uniformly across GitHub, GitLab, Azure DevOps and Bitbucket and needs no per-member activity API. It degrades to no finding when the commit history cannot be read (for example, a token without the necessary scope).

The signal is commit recency, not organization membership — a committer who has stopped committing is flagged even if still a member. Treat findings as a prompt to review whether the identity should retain access, not as proof of abandonment.

Security

Periodic review and removal of inactive identities shrinks the attack surface: fewer standing credentials means fewer paths an attacker can use if a token or account is compromised. It is a core access-hygiene control (SPVS V1.1.4, CIS SSC 1.3.1).

Mitigation / Fix

Review the reported identities and revoke access for those no longer active (remove from the org/project, disable or delete their tokens). Establish a recurring access-review process so this is done routinely rather than ad hoc.

Configuration

To change these options you can modify SCANNER_DIR/conf/misconfigurations/stale_vcs_identities.yml. The following are the default configuration properties:

properties:
  # A committer whose most recent commit is older than this many days is considered inactive.
  inactiveDays: 60