GitHub Forensics — Blog https://www.githubforensics.com/en/blog Latest from Blog en Sun, 27 Sep 2026 20:41:49 GMT GitHub audit log limitations: retention, gaps, plans https://www.githubforensics.com/en/blog/github-audit-log-limitations https://www.githubforensics.com/en/blog/github-audit-log-limitations What the GitHub audit log does not record: 180-day and 7-day retention, plan limits for API and Git events, hidden IPs, no file contents or secret reads. Florian Amette Sun, 27 Sep 2026 00:00:00 GMT GitHub supply chain attack investigation: a walkthrough https://www.githubforensics.com/en/blog/github-supply-chain-attack-investigation https://www.githubforensics.com/en/blog/github-supply-chain-attack-investigation A fictional GitHub supply chain attack investigated end to end: stolen PAT, 38 repos cloned, AWS keys printed by a workflow, branch protection removed. Florian Amette Thu, 24 Sep 2026 00:00:00 GMT Leaked cloud keys in GitHub Actions: the cloud pivot https://www.githubforensics.com/en/blog/leaked-cloud-keys-github-actions https://www.githubforensics.com/en/blog/leaked-cloud-keys-github-actions AWS, Google Cloud or Azure keys leaked from GitHub Actions or a repo: contain the key, trace its use in the cloud audit logs, then replace keys with OIDC. Florian Amette Tue, 22 Sep 2026 00:00:00 GMT Branch protection disabled? Auditing GitHub rulesets https://www.githubforensics.com/en/blog/branch-protection-ruleset-tampering https://www.githubforensics.com/en/blog/branch-protection-ruleset-tampering Investigate GitHub branch protection or ruleset tampering: protected_branch.destroy, ruleset changes, admin overrides, environments, and what landed meanwhile. Florian Amette Sat, 19 Sep 2026 00:00:00 GMT GitHub org takeover: owners, 2FA, SSO and IP allow list https://www.githubforensics.com/en/blog/github-organization-takeover https://www.githubforensics.com/en/blog/github-organization-takeover GitHub organization takeover indicators in the audit log: new owners, 2FA requirement off, SAML SSO changed, IP allow list off, audit streaming removed. Florian Amette Thu, 17 Sep 2026 00:00:00 GMT Self-hosted runner security: GitHub Actions forensics https://www.githubforensics.com/en/blog/self-hosted-runner-security https://www.githubforensics.com/en/blog/self-hosted-runner-security Rogue or compromised GitHub self-hosted runners: the audit log events to check, host evidence in _diag, and how to scope and rebuild after an incident. Florian Amette Tue, 15 Sep 2026 00:00:00 GMT GitHub Actions secrets leak: investigating exfiltration https://www.githubforensics.com/en/blog/github-actions-secrets-leak https://www.githubforensics.com/en/blog/github-actions-secrets-leak How GitHub Actions secrets leak despite *** masking: poisoned workflows, new branches, encoded output and third-party actions. The evidence to collect and read. Florian Amette Sat, 12 Sep 2026 00:00:00 GMT Detecting GitHub repo exfiltration and mass cloning https://www.githubforensics.com/en/blog/github-repository-exfiltration https://www.githubforensics.com/en/blog/github-repository-exfiltration Find source code theft in the GitHub audit log: git.clone bursts, ZIP archive downloads, repos made public or transferred, forks, and what each leaves behind. Florian Amette Thu, 10 Sep 2026 00:00:00 GMT Leaked GitHub token: what to do and how to investigate https://www.githubforensics.com/en/blog/leaked-github-token https://www.githubforensics.com/en/blog/leaked-github-token A GitHub PAT or OAuth token leaked? Revoke it, find its hashed_token in the audit log, check new IPs, countries and clones, then scope what the token reached. Florian Amette Tue, 08 Sep 2026 00:00:00 GMT GitHub audit log analysis: step-by-step in your browser https://www.githubforensics.com/en/blog/github-audit-log-analysis https://www.githubforensics.com/en/blog/github-audit-log-analysis Analyze GitHub audit log exports offline: drop JSON, Git events and Actions logs, read the verdict, triage findings, pivot on tokens and IPs, export a report. Florian Amette Sat, 05 Sep 2026 00:00:00 GMT How to export the GitHub audit log (UI, API, streaming) https://www.githubforensics.com/en/blog/export-github-audit-log https://www.githubforensics.com/en/blog/export-github-audit-log Export the GitHub audit log for forensics: UI JSON/CSV, REST API with include=all, streaming files, Git events and Actions logs, with the limits of each source. Florian Amette Thu, 03 Sep 2026 00:00:00 GMT GitHub organization compromised? Incident response guide https://www.githubforensics.com/en/blog/github-organization-compromised https://www.githubforensics.com/en/blog/github-organization-compromised What to do when your GitHub organization is compromised: preserve the audit log, contain tokens and workflows, scope with Git events, then pivot to the cloud. Florian Amette Tue, 01 Sep 2026 00:00:00 GMT