Glossary

Plain-language definitions of the GitHub audit log and incident-response terms used in our guides.

OIDC federation (GitHub Actions): Workflows request a short-lived OpenID Connect token that a cloud provider exchanges for temporary credentials, instead of storing long-lived keys.
Branch protection and repository rulesets: GitHub rules that guard branches and tags: required reviews, status checks, no force-pushes. Removing them lets one credential rewrite main.
IP allow list: A GitHub Enterprise Cloud control that blocks web, API and Git access to an organization or enterprise from IP addresses outside approved ranges.
SAML single sign-on (SSO): Delegating GitHub organization or enterprise authentication to an identity provider; tokens and SSH keys must be authorized for SSO to reach resources.
Self-hosted runner: A machine you operate that runs GitHub Actions jobs. It is not reset between jobs unless ephemeral, and it often sits inside your network.
Poisoned pipeline execution: Running attacker code in a CI/CD pipeline by modifying its configuration or the code it builds, to steal secrets or tamper with artefacts (ATT&CK T1677).
Secret masking (Actions log redaction): GitHub Actions replaces registered secret values with *** in run logs. Transformed values (base64, reversed, split) are not masked.
Deploy key: An SSH key attached to a single GitHub repository. Read-only by default; with write access it can push, and it survives password and token resets.
hashed_token: The base64 SHA-256 of the access token behind a GitHub audit log event, used to follow one credential across events without storing it.
Personal access token (PAT): A GitHub credential that acts as a user for API and Git access. Classic PATs carry broad scopes, fine-grained PATs are limited to chosen repositories.
Audit log streaming: Continuous export of a GitHub enterprise's audit and Git events to S3, Azure, GCS, Datadog or Splunk, beyond the 180-day and 7-day limits.
Git events: Audit log entries for Git operations (git.clone, git.fetch, git.push), kept only seven days and needed to detect mass cloning.
GitHub audit log: The record of security-relevant actions in a GitHub organization or enterprise: who did what, when, from where and with which credential.