Series
GitHub incident response playbooks
8 posts in this series. Read them in order or jump to any one.
- GitHub organization compromised? Incident response guide
What to do when your GitHub organization is compromised: preserve the audit log, contain tokens and workflows, scope with Git events, then pivot to the cloud.
- Leaked GitHub token: what to do and how to investigate
A GitHub PAT or OAuth token leaked? Revoke it, find its hashed_token in the audit log, check new IPs, countries and clones, then scope what the token reached.
- Detecting GitHub repo exfiltration and mass cloning
Find source code theft in the GitHub audit log: git.clone bursts, ZIP archive downloads, repos made public or transferred, forks, and what each leaves behind.
- GitHub Actions secrets leak: investigating exfiltration
How GitHub Actions secrets leak despite *** masking: poisoned workflows, new branches, encoded output and third-party actions. The evidence to collect and read.
- Self-hosted runner security: GitHub Actions forensics
Rogue or compromised GitHub self-hosted runners: the audit log events to check, host evidence in _diag, and how to scope and rebuild after an incident.
- GitHub org takeover: owners, 2FA, SSO and IP allow list
GitHub organization takeover indicators in the audit log: new owners, 2FA requirement off, SAML SSO changed, IP allow list off, audit streaming removed.
- Branch protection disabled? Auditing GitHub rulesets
Investigate GitHub branch protection or ruleset tampering: protected_branch.destroy, ruleset changes, admin overrides, environments, and what landed meanwhile.
- Leaked cloud keys in GitHub Actions: the cloud pivot
AWS, Google Cloud or Azure keys leaked from GitHub Actions or a repo: contain the key, trace its use in the cloud audit logs, then replace keys with OIDC.