Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Assume an exposed API key or GitHub token is compromised. Revoke or rotate it first, update every service that used it, then investigate provider and GitHub logs for activity during the period of exposure. For a GitHub token used against an organization, GitHub documents a token-specific search: calculate the token’s SHA-256 hash and query the organization audit log with hashed_token:"HASH". That search does not include Git events; Git-event activity must be obtained from exported Git-event data. Retention, permissions, and source-IP visibility can leave gaps, so a clean search is not proof that a credential was never used.
What should I do immediately after finding a leaked credential?
Containment comes before log analysis. An attacker can use a valid key while you are still collecting evidence, and every additional copy of the secret increases exposure.
As an Amazon Associate I earn from qualifying purchases.
- Identify the credential without copying its value. Record the credential type, the repository, build log, file, or system where it appeared, the discovery time, the likely owner, and the services that consume it. Put only a redacted identifier or fingerprint in tickets and chat.
- Revoke or rotate it. Delete a compromised GitHub personal access token and create a replacement. For another provider’s API key, use that provider’s revoke or regenerate control. GitHub’s secret-scanning guidance says to rotate an affected credential immediately and treat a secret committed to a repository as compromised.
- Update dependencies. Replace the old value in CI variables, deployment systems, applications, notebooks, automation accounts, and local development environments. A rotation is incomplete while any workload still sends the old credential.
- Verify validity and ownership. Where GitHub provides a validity check, use it to prioritize triage, then check the provider’s security or usage logs for unauthorized activity. Record who approved the replacement and when the old value became unusable.
GitHub also documents a credential-revocation API for supported token types. A valid token submitted to that endpoint is automatically revoked, and the request does not require authentication. Support is token-type-specific, so confirm the current supported list before relying on it; this mechanism is not a universal revocation method for arbitrary API keys.
What evidence can GitHub’s different log sources show?
“The GitHub audit log” is not one complete event stream. Organization events, Git events, streamed events, and secret-scanning alerts have different coverage, retention, and access rules.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
| Source | Useful evidence | Access and retention considerations |
|---|---|---|
| Organization audit log (web or REST) | Actor, action, repository or resource, event time, authentication details, and—when available—token hash, authentication type, scopes, and source IP. | GitHub’s organization documentation describes a 180-day window for organization events. The web interface may initially show only the previous three months; specify an older range when needed. Access depends on organization or enterprise privileges. |
| Exported Git-event data | Git operations and authentication fields that can associate Git activity with a token. | Ordinary organization audit-log searches in the web interface and REST API do not return Git events. GitHub documents a seven-day retention window for Git events in the relevant methods, so collect them quickly. |
| External audit-log streaming | A continuously delivered event copy that can be queried with a log-management or SIEM system and retained beyond the built-in window. | Retention is controlled by the receiving system. Streaming, API-request events, and source-IP disclosure must have been configured before the incident to provide their extra visibility. |
| Secret-scanning alerts | Where GitHub detected a secret, the affected location, alert status, and supported validity or metadata signals. | Alerts complement log review. They do not prove how a credential was used, and GitHub describes GitHub-token metadata as public preview that may change. |
Before searching, write down the organization or enterprise account, the exact date range, the interface or export used, whether Git events were included, and whether source-IP disclosure or API-request logging was enabled. Those details make later conclusions reproducible and expose visibility gaps instead of hiding them.
How do I search an organization audit log for a specific GitHub token?
Use the token’s SHA-256 hash, never the raw token. The documented qualifier is hashed_token:"HASH", where HASH is the lowercase hexadecimal SHA-256 value.
Free tools Windows power users keep installed
One-click scans. No signup required.
1. Hash the token locally
Do this on a trusted workstation or in an approved incident environment. Do not paste a live token into a web hash service, a shell history, a ticket, or a sample log.
On macOS or Linux, load the value without echoing it and pipe it directly to OpenSSL:
read -s TOKEN
printf 'n'
printf %s "$TOKEN" | openssl dgst -sha256OpenSSL prints a digest line. Copy only the hexadecimal digest into your investigation notes, then clear the shell variable when your procedure allows.
In PowerShell on a current .NET runtime, read the value from a protected environment or secret manager and hash its UTF-8 bytes:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems$bytes = [Text.Encoding]::UTF8.GetBytes($env:GITHUB_TOKEN)
$hash = [Security.Cryptography.SHA256]::HashData($bytes)
[Convert]::ToHexString($hash).ToLowerInvariant()If your PowerShell runtime lacks SHA256.HashData, use your organization’s approved cryptographic library rather than sending the token to a third party. Confirm that the input encoding and digest format match GitHub’s documented SHA-256 search procedure.
2. Search in the web interface
- Open the affected organization’s settings and go to Logs, then Audit log (labels can vary by GitHub account and plan).
- Enter the quoted phrase
hashed_token:"HASH"using the digest, not the token itself. - Set a date range that begins before the first possible exposure and ends after the credential was revoked. Do not rely on the interface’s default three-month view.
- Review matching events in chronological order and export the results in JSON or CSV when your access permits.
3. Search through the REST interface when you need repeatability
Use the organization audit-log REST endpoint with the same search phrase and the appropriate organization or enterprise authorization. URI-escape the hash and the quotation marks when placing the phrase in a request. Save the exact request parameters, response timestamp, and pagination information with the case record, but never save the raw token.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
4. Interpret token fields carefully
A matching event can contain hashed_token, programmatic_access_type, and, when applicable, token_scopes. These fields help distinguish personal access token, OAuth token, or GitHub App authentication. GitHub’s documentation also discusses token-related data for deploy keys and SSH keys; those displays are identified as public preview and can change.
Search results are evidence of events represented in that source and time window, not a universal statement about every use of the credential. Continue with Git-event data and provider-side logs.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Why doesn’t an empty audit-log search prove that a token was unused?
An empty web or REST result can mean the token was unused, but it can also reflect the wrong source, date range, permissions, or retention window. Most importantly, ordinary organization audit-log searches do not return Git events.
Git activity requires a separate export
When the question includes clone, fetch, push, or other Git operations, obtain the organization’s exported Git-event data and inspect its authentication fields. Do not infer Git use from the absence of ordinary audit events. Git-event token display is documented as public preview, so preserve the export and the documentation version used to interpret it.
Retention can erase the relevant period
The documented organization-event window is 180 days, while the documented Git-event window in the relevant methods is seven days. An incident discovered after those periods may have no retrievable event even if the token was used. If audit logs were streamed, the receiving system may retain older data, but its retention policy—not GitHub’s built-in window—controls availability.
Configuration and permissions can hide activity
API-request events, source-IP disclosure, and enterprise streaming are configuration-dependent. If they were not enabled, the resulting record may lack request-level detail or IP addresses. An investigator who lacks the necessary organization or enterprise access may see fewer events than an administrator.
How should I correlate matching events with the leak?
Build a timeline rather than treating one matching row as a verdict. For every event, capture the actor, action, affected repository or resource, event time, authentication method, scopes when shown, and source IP or location when available.
Compare the actor and location with expected use
Map each actor to a known employee, bot, integration, or deployment job. GitHub recommends looking for unexpected actors and unknown IP addresses when IP disclosure is enabled. Consider VPNs, cloud runners, NAT gateways, and scheduled jobs before labeling an address malicious, but preserve the original address and the reasoning behind your classification.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Compare actions with the credential’s purpose
A read-only build token should not be creating repositories, changing permissions, or downloading unusual volumes. A deployment integration may legitimately write to a release repository but not access unrelated private projects. Use the token’s recorded scopes where available, then compare the event sequence with deployment calendars, pull requests, issue activity, and identity-provider records.
Check the exposure interval
Mark when the credential first appeared, when it may have been copied into logs or artifacts, when suspicious activity began, and when revocation completed. Activity before discovery can establish misuse; activity after rotation may indicate a second copy, a delayed job, or a different credential. Keep these hypotheses separate until provider logs confirm them.
How do secret-scanning alerts help during a log investigation?
Secret scanning tells you where GitHub detected a credential and helps find additional copies; it does not replace provider and audit-log analysis.
- Review the alert’s repository, branch or history location, detection time, status, and any supported validity result.
- Use documented location information to inspect commits, pull requests, issues, discussions, workflow files, and other supported GitHub content without copying the secret into new records.
- Where available, use GitHub-token metadata such as last-used information to prioritize which alerts deserve immediate correlation. Treat metadata as public preview and subject to change, not as an immutable forensic record.
- Search the codebase and Git history for other credentials, including source files,
.envfiles, CI configuration, deployment manifests, and generated artifacts. Secret scanning has documented coverage but cannot establish that every possible leak location was scanned.
After rotation, resolve the alert with an accurate status and retain the evidence needed to explain why. Removing a value from Git history can be time-intensive; GitHub’s remediation guidance says it is often unnecessary once the credential has been revoked. Prioritize invalidation and prevention of future exposure, and rewrite history only when your risk assessment requires it.
How can I look for broader misuse or data exfiltration?
Expand the investigation beyond the one token match. A stolen credential may have been used to discover repositories, enumerate organizations, or move data without triggering the exact event you expected.
Search for related credentials
Run code and history searches for the same provider, key prefixes, configuration names, and neighboring secrets. Check forks, tags, release archives, build artifacts, container layers, and copied workflow files where your organization’s controls permit. Rotate every credential that may share the same exposure path.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Review high-volume and unusual operations
GitHub’s incident guidance highlights high-volume Git operations and unusual API activity as potential exfiltration indicators. Compare clone, fetch, archive, package, and API request volume with the integration’s normal baseline. A single large transfer may be legitimate, so correlate volume with actor, destination, time, and approved work.
Use provider-side evidence
GitHub logs cannot show use of a non-GitHub API key at another service. Query that provider’s authentication, request, billing, and security logs for the same time window, source addresses, user agent, resource identifiers, and error patterns. Preserve raw exports under restricted access before retention removes them.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Which log source or retrieval method should I choose?
Use the built-in audit log for a quick organization-event search, exported Git-event data for Git operations, and external streaming when you need longer retention or advanced correlation.
| Method | Best for | Main limitation | Prerequisites |
|---|---|---|---|
| Web audit-log search | Interactive review of organization events and token-hash queries. | Does not return Git events; default date display may be narrower than the available window. | Appropriate organization access and a defined date range. |
| REST audit-log search | Repeatable queries, automation, and machine-readable responses. | Has the same event-coverage limits as the ordinary organization search and requires careful URI escaping and pagination. | API authorization and permission to read the organization audit log. |
| Git-event export | Token-authenticated Git activity and authentication fields. | Shorter documented retention and separate handling from ordinary audit events. | Ability to request or access the export within the retention period. |
| External streaming | Advanced queries, cross-system correlation, and retention beyond built-in windows. | Cannot recover events that were never streamed; retention and indexing depend on the receiving system. | Enterprise streaming, API-request and source-IP settings where needed, plus a log-management system. |
GitHub recommends streaming enterprise audit logs to an external SIEM or log-management system when an organization needs advanced querying or longer retention. No particular product is required; assess the receiving system’s access controls, retention, search language, export capability, and legal-hold process.
How do I preserve evidence and close the incident?
- Export before retention expires. Save matching organization events, Git-event exports, alert details, and provider-side logs in their native formats. Record export times, query phrases, date ranges, and the account that performed each search.
- Protect the evidence. Restrict access, encrypt stored exports, record hashes of files if your incident process requires integrity checks, and keep raw credentials out of every artifact.
- Document limitations. State whether Git events were available, whether API-request events and source IPs were enabled, which retention windows applied, and which accounts or repositories were outside your access.
- Confirm remediation. Test that services now use the replacement credential, verify that the old value fails where appropriate, and check for scheduled jobs or cached secrets that still reference it.
- Resolve alerts accurately. Close secret-scanning alerts only with the status that matches the action taken. Keep a link between the alert, rotation record, log exports, and owner approval without embedding the secret.
- Improve prevention. Add secret scanning to repositories and CI, prevent secrets from entering build logs, narrow token scopes, use short-lived credentials where supported, and ensure future audit events and source-IP data are streamed to a retained system.
What common mistakes make this investigation unreliable?
Searching for the raw token
Raw-token searches can leak the credential into browser history, proxy logs, shell history, or support tickets. Hash locally and search only the documented token qualifier.
Assuming one interface contains every event
Organization UI and REST searches omit Git events. Obtain the separate Git-event export and identify which source produced every conclusion.
Using the default date range
A three-month display can hide older organization events that remain within the documented 180-day window. Explicitly set the start and end dates and record them.
Calling “no result” proof of no use
A missing match may reflect seven-day Git retention, disabled streaming or API-request logging, unavailable source-IP disclosure, insufficient permissions, or an event outside the searched account. Report the uncertainty instead of declaring the token unused.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rotating without updating consumers
Applications that still hold the old value may fail unpredictably, while an attacker with a copied value may continue using it. Inventory and test every dependent service.
Treating preview metadata as permanent
GitHub-token validity and last-used metadata can assist triage, but preview fields may change. Base the final incident record on preserved events and provider evidence as well.
FAQ: questions responders ask next
Can I determine the exact person who used a leaked token?
Audit records usually identify an authenticated actor or integration, not the human at a keyboard. Correlate the actor with identity-provider logs, runner assignments, IP ownership, deployment records, and time-zone context before attributing activity to an individual.
Will revoking a token stop an already running Git operation?
Revocation prevents subsequent authentication, but an operation that already received authorization may continue briefly or complete. Check repository and provider logs after revocation and invalidate related sessions or credentials when the provider supports that control.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Can a SHA-256 token hash be used to search another API provider?
No. The hashed_token qualifier is a GitHub organization audit-log mechanism. Other providers may log key IDs, token fingerprints, request signatures, or no token identifier at all, so use the fields and search tools documented by that provider.
Should I rewrite Git history after rotating the credential?
Not automatically. Rotation removes the credential’s ability to authenticate, while history rewriting can disrupt clones, forks, signatures, and auditability. Choose a rewrite only when policy, legal requirements, or residual exposure justifies the operational cost, and coordinate it with every repository consumer.
Frequently Asked Questions
Can I determine the exact person who used a leaked token?
Audit records usually identify an authenticated actor or integration, not the human at a keyboard. Correlate the actor with identity-provider logs, runner assignments, IP ownership, deployment records, and time-zone context before attributing activity to an individual.
Will revoking a token stop an already running Git operation?
Revocation prevents subsequent authentication, but an operation that already received authorization may continue briefly or complete. Check repository and provider logs after revocation and invalidate related sessions or credentials when the provider supports that control.
Recommended Free Tools
Can a SHA-256 token hash be used to search another API provider?
No. The hashed_token qualifier is a GitHub organization audit-log mechanism. Other providers may log key IDs, token fingerprints, request signatures, or no token identifier at all, so use the fields and search tools documented by that provider.
Should I rewrite Git history after rotating the credential?
Not automatically. Rotation removes the credential’s ability to authenticate, while history rewriting can disrupt clones, forks, signatures, and auditability. Choose a rewrite only when policy, legal requirements, or residual exposure justifies the operational cost, and coordinate it with every repository consumer.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
