Blog

What the GitHub audit log does not record: 180-day and 7-day retention, plan limits for API and Git events, hidden IPs, no file contents or secret reads.

A fictional GitHub supply chain attack investigated end to end: stolen PAT, 38 repos cloned, AWS keys printed by a workflow, branch protection removed.

AWS, Google Cloud or Azure keys leaked from GitHub Actions or a repo: contain the key, trace its use in the cloud audit logs, then replace keys with OIDC.

Investigate GitHub branch protection or ruleset tampering: protected_branch.destroy, ruleset changes, admin overrides, environments, and what landed meanwhile.

GitHub organization takeover indicators in the audit log: new owners, 2FA requirement off, SAML SSO changed, IP allow list off, audit streaming removed.

Rogue or compromised GitHub self-hosted runners: the audit log events to check, host evidence in _diag, and how to scope and rebuild after an incident.

How GitHub Actions secrets leak despite *** masking: poisoned workflows, new branches, encoded output and third-party actions. The evidence to collect and read.

Find source code theft in the GitHub audit log: git.clone bursts, ZIP archive downloads, repos made public or transferred, forks, and what each leaves behind.

A GitHub PAT or OAuth token leaked? Revoke it, find its hashed_token in the audit log, check new IPs, countries and clones, then scope what the token reached.