Skip to content
GitHub Forensics

This tool is not affiliated with, endorsed by or sponsored by GitHub, Inc. or Microsoft Corporation. GitHub and GitHub Actions are trademarks of GitHub, Inc. Other names are trademarks of their respective owners.

Glossary

Deploy key

An SSH key attached to a single GitHub repository. Read-only by default; with write access it can push, and it survives password and token resets.

A deploy key is an SSH public key added to one repository rather than to a user account, typically for a server that needs to pull code. Deploy keys are read-only by default, and write access is optional. A write-enabled deploy key can push to the repository.

Because a deploy key is not tied to a person, revoking a user's tokens or resetting their password does not remove it. That makes it a favourite form of persistence. It appears in the audit log as public_key.create, with fields such as title, read_only and fingerprint. See the incident response guide.

This tool is not affiliated with, endorsed by or sponsored by GitHub, Inc. or Microsoft Corporation. GitHub and GitHub Actions are trademarks of GitHub, Inc. Other names are trademarks of their respective owners.