iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Act as though the attacker still has access until you revoke every route in. Change the GitHub password, terminate unfamiliar sessions, revoke unknown tokens and app authorizations, remove unrecognized SSH or deploy keys, and secure the email account linked to GitHub. Then create replacement credentials, enable strong two-factor authentication with independent recovery methods, and audit repositories and account activity for changes you did not make.
1. Contain access before investigating anything else
Do the first containment steps in sequence. A password change alone does not invalidate every active session, token, OAuth authorization, GitHub App grant, SSH key, or deploy key.
- Change the GitHub password. Open your profile menu, choose Settings, then Password and authentication, and set a new, unique password. Do not reuse a password from another service. If you cannot sign in, use GitHub’s account-recovery flow rather than repeatedly guessing credentials.
- Review and revoke sessions. In Settings, open Sessions. GitHub states, “You can view and revoke your active sessions in your settings.” Revoke every browser or GitHub Mobile session you do not recognize. When in doubt, revoke all sessions and sign in again on devices you control.
- Revoke personal access tokens. Go to Settings → Developer settings → Personal access tokens. Check both fine-grained and classic token lists if both are present. Delete or revoke every token you did not create, and any token that may have been exposed. Treat a token as a password: its label may be misleading, so check creation dates, repository access, expiration and last-use information where shown.
- Remove unfamiliar OAuth and GitHub App access. Open Settings → Applications and inspect Authorized OAuth Apps and Authorized GitHub Apps. Revoke anything you do not recognize or no longer need. GitHub documents that, if you believe your credentials may be compromised, you can revoke all authorizations to protect enterprises you can access.
- Delete unknown SSH keys. In Settings → SSH and GPG keys, remove every public key you did not add. GitHub warns that “An unidentified public key may indicate a possible security concern.” Removing a key prevents future Git-over-SSH authentication with its private counterpart.
- Inspect repository deploy keys. For each repository you own or administer, open Settings → Deploy keys. Delete unfamiliar keys, especially keys with write access. Deploy keys are attached to individual repositories and therefore require a repository-by-repository review.
- Secure the linked email account. Change that mailbox’s password, enable its strongest available multi-factor method, review forwarding rules and recovery addresses, and terminate unknown mailbox sessions. An attacker who controls your email can reset GitHub credentials even after you clean up GitHub itself.
Make a note of every credential you revoke. GitHub says bulk credential-deletion and revocation actions are irreversible, and the documentation cautions, “These actions are irreversible.” Do not use a bulk action casually if you still need to identify which automation uses which credential.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches2. Choose between immediate revocation and staged rotation
The right approach depends on whether an attacker may still be active and how much automation depends on the credentials.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Approach | When to use it | Benefit | Cost or risk |
|---|---|---|---|
| Revoke everything unfamiliar immediately | You see active abuse, unknown access, exposed secrets, or cannot establish which credentials are safe. | Stops the suspected access paths as quickly as possible. | Builds, deployment jobs, scripts and integrations can fail until replacement credentials are installed. |
| Staged rotation | You have no sign of active use and can inventory each credential and its consumer. | Lets you create and test replacements before removing a still-needed credential. | Leaves a potentially compromised credential usable for longer; never choose this when active intrusion is plausible. |
If you choose immediate revocation, expect automation downtime and plan the replacement work in the next section. Do not delay containment merely to keep a pipeline green.
3. Replace credentials and repair automation
Create new credentials only after the old or suspicious ones are revoked. Otherwise an attacker may continue using the old credential while you are setting up the replacement.
Personal access tokens
- Open Settings → Developer settings → Personal access tokens and create the narrowest token that meets the task.
- Set an expiration date and grant only the repositories and permissions required. A token used for one repository should not have organization-wide administration rights.
- Record which script, runner or service receives the token. Store it in the service’s encrypted secret store, not in source code, an issue, a build log or a shell-history file.
- Run a controlled test, then remove the temporary or superseded token.
SSH authentication
- Generate a new key pair on the machine or managed workstation that will use it. Protect the private key with a passphrase.
- Add only the new public key under Settings → SSH and GPG keys, with a descriptive title that identifies the device and purpose.
- Test authentication with the new key, then remove the old or exposed public key from GitHub and any other systems that accepted it.
CI/CD, deployment and scripts
Search every workflow, runner, deployment host, container secret, environment variable and local script that used a revoked token or key. Replace the secret in the system that actually stores it, not merely in a GitHub repository file. Trigger a safe test run and confirm that logs do not print the value. If a deployment key was removed, update the consuming service with a newly generated key and verify that its repository scope is correct.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Also search commit history and build artifacts for accidentally committed credentials. Revoking a token prevents future use but does not erase a value already copied into a clone, log, cache or artifact; those copies need their own cleanup and access review.
4. Harden sign-in with multiple recovery paths
After containment, enable two-factor authentication (2FA). Configure at least two independent recovery methods before you close the incident. Keep recovery codes in a secure place separate from the device used for daily sign-in.
| Method | Phishing resistance | Device and recovery considerations | Best use |
|---|---|---|---|
| Passkey | High. GitHub describes passkeys as phishing-resistant. | Uses a compatible device or passkey manager; no memorized secret is required. Maintain another recovery method in case the device is lost. | Primary sign-in on supported personal devices. |
| FIDO2/WebAuthn security key | High when used for GitHub authentication. | A physical key is kept separately and can provide an independent recovery factor. Register more than one key if possible. | Strong protection for administrators, developers and recovery. |
| TOTP authenticator | Better than a password alone, but codes can be phished in real time. | Requires access to the authenticator’s seed or backup process. Keep recovery codes separately. | Practical second factor when passkeys or security keys are unavailable. |
| SMS | Lower resistance because phone-number takeover and message interception are possible. | Depends on cellular service and control of the number. | Fallback where stronger methods cannot be used; do not make it the only recovery option. |
GitHub’s documentation says, “Passkeys are phishing-resistant, and they don’t require memorization or active management.” A FIDO2 security key is a hardware second factor that GitHub supports for authentication and recovery. Register the key under Settings → Password and authentication → Two-factor authentication, follow GitHub’s enrollment prompts, and immediately store the generated recovery codes.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Save recovery codes correctly
- Download or print the one-time recovery codes when GitHub offers them; do not leave the only copy in an account that could be locked.
- Store them in an encrypted password manager or another protected offline location with access controls.
- Keep a second copy in a separate secure location. Do not email the codes to yourself or commit them to a repository.
- Regenerate the set if you believe the codes were viewed. Regeneration invalidates the previous set.
Before finishing the incident, test that you can use at least two independent methods—for example, a passkey plus a security key, or a security key plus TOTP and recovery codes. GitHub warns that losing every 2FA credential and recovery method can permanently prevent account recovery.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
5. Audit what the attacker may have changed
Once access is contained, look for persistence and damage. Security settings show only part of an intrusion.
Account and organization activity
- Open the account Security log and examine events around the suspected time: sign-ins, password and 2FA changes, token creation, key additions, application authorizations, repository access and organization changes.
- Review your profile’s organizations, teams, outside collaborators and repository invitations. Remove memberships or invitations you did not approve, and ask organization owners to check their audit logs.
- Inspect every webhook at the repository and organization level. Unknown webhook URLs can exfiltrate event data or trigger external jobs; remove them and investigate the receiving service.
- Review authorized OAuth applications and GitHub Apps again after the initial cleanup, including grants made through organizations you administer.
Repository content and permissions
- Compare recent commits, branches, tags, releases and pull requests with your own work. Look for altered workflow files, dependency manifests, release artifacts, documentation, issue comments or hidden branches.
- Check repository collaborators, outside collaborators, team permissions and branch-protection rules. Restore least-privilege access and require review for sensitive branches.
- Inspect deploy keys, repository secrets, environments and environment-protection rules. Rotate any secret that could have been read by an unauthorized workflow.
- Search for unauthorized changes that create persistence, such as a new workflow, scheduled job, webhook, collaborator, deploy key or application authorization.
Respond to unauthorized changes
Preserve timestamps, commit IDs, security-log events and affected repository names before deleting evidence. Revert malicious commits through a reviewed change, remove unauthorized access, and rotate secrets that the changed code could read. If the repository belongs to an organization or another owner, notify the owner immediately so they can coordinate the response and check dependent systems.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
6. Recover access if you lost 2FA
You still have one recovery method
Use the available passkey, security key, authenticator code or recovery code to sign in. Afterward, open Settings → Password and authentication, remove the lost factor, register a replacement, and generate a fresh set of recovery codes.
You lost every factor and recovery code
GitHub’s position is explicit: “For security reasons, GitHub Support will not be able to restore access to accounts with two-factor authentication enabled if you lose your two-factor authentication credentials or lose access to your account recovery methods.” Do not assume that proving ownership of an email address guarantees restoration.
Where GitHub offers an eligible recovery-verification process, complete the requested checks promptly. The documented review can take up to three business days. If the account is restricted during the incident, follow the instructions in GitHub’s security email; contact Support only when the documented restriction or recovery process does not resolve the problem.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
When an organization is involved
If the inaccessible account administers repositories or organizations, tell another owner immediately. They may be able to protect repositories, rotate organization secrets, remove suspicious collaborators and preserve audit evidence while your personal access issue is handled. Do not create a replacement personal account and assume it inherits the old account’s permissions.
7. Prevent a repeat compromise
- Use a unique, long GitHub password and store it in a reputable password manager.
- Prefer a passkey or FIDO2 security key, and keep at least two independent recovery methods registered.
- Review sessions, authorized applications, personal access tokens and SSH keys on a regular schedule and after using an unfamiliar device.
- Give tokens, deploy keys, repository secrets and GitHub Apps the smallest scope and shortest lifetime practical.
- Use separate credentials for personal work, automation and production deployment so one compromise cannot unlock everything.
- Require pull-request review for workflow and deployment changes, and limit who can approve or run privileged workflows.
- Monitor security-log and organization-audit events, especially after staff changes, device loss or unexpected repository activity.
- Document which service owns each token, key and webhook. An inventory makes emergency revocation possible without guessing which automation will fail.
A suspected compromise is contained only when unknown access paths are revoked, replacement credentials work, strong 2FA and recovery methods are in place, and repository and account activity show no remaining unauthorized changes.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
