Assume every credential the compromised job could read or obtain is compromised. Stop active runs when the evidence justifies it, determine exactly which tokens and secrets were reachable, revoke long-lived credentials, issue replacements, update every GitHub secret store and connected service, and investigate what happened. The default GITHUB_TOKEN is different: it is created for each job and expires automatically with the job lifecycle, while personal access tokens, GitHub App refresh tokens, and third-party keys can remain valid until you revoke or replace them.
What to do first
Do not wait for proof that an exposed credential was used. GitHub’s incident guidance is to treat any credential that may have been exposed as compromised and rotate or replace it immediately. A token appearing in a log or repository does not prove that anyone used it, but uncertainty is a reason to contain and rotate—not a reason to leave it active.
As an Amazon Associate I earn from qualifying purchases.
- Preserve evidence. Record the workflow file, run IDs, job timestamps, runner type, logs, changed files, and the names and locations of credentials before making changes that could erase useful context.
- Stop active execution when warranted. Cancel in-progress runs, disable Actions for the affected repository or organization, or remove affected self-hosted runners if there is credible evidence of an active attack. Choose the narrowest action that contains the threat.
- Inventory access. Inspect the workflow, called actions, scripts, run logs, repository and organization settings, environment protection rules, and credentials acquired during the job.
- Revoke and replace. Revoke exposed PATs, app credentials, and external service keys through their owning systems. Create replacements and update every consumer.
- Investigate and harden. Review audit activity and persistence, fix the workflow’s root cause, reduce permissions, pin dependencies, and only then restore normal operation.
Decide whether immediate containment is necessary
Emergency controls can stop an attacker, but they can also interrupt releases, deployments, and scheduled maintenance. Base the response on the nature of the threat, its likely scope, the evidence available, and the disruption each control causes.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Evidence or situation | Proportionate first action | Trade-off |
|---|---|---|
| A malicious step is still running, a runner is making unexplained network calls, or new unauthorized changes are appearing | Cancel active runs immediately; isolate or remove affected self-hosted runners. Disable Actions at repository or organization level if narrower controls cannot contain it. | Stops automation and may interrupt legitimate deployments, but limits continuing access. |
| A completed run may have exposed credentials, with no evidence of ongoing execution | Keep the workflow offline if practical, preserve evidence, and begin credential inventory and rotation promptly. | Less disruption than a blanket shutdown, while still addressing reusable credentials. |
| Only one repository, environment, or account is implicated | Use targeted repository, environment, runner, and credential controls first. | Requires more precise analysis but avoids taking unrelated automation offline. |
| Several repositories or an organization-wide action or secret may be affected | Expand containment to the organization after confirming the blast radius; involve enterprise administrators when available. | Broader protection causes broader operational impact. |
Disabling Actions is not a substitute for revoking credentials. It prevents new workflow execution but does not automatically make a long-lived PAT or external API key invalid. Likewise, removing a runner addresses one execution surface; it does not undo access already obtained elsewhere.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Determine what the compromised job could access
Read the workflow as an access map, not just as a build recipe. A job can receive credentials directly through the secrets context, obtain them from files or environment variables, or exchange an existing token for another credential. Review both the workflow and every action or script it invokes.
Review the workflow and its execution context
- Identify the repository, branch, event trigger, reusable workflows, matrix variants, and environments involved.
- Note every
permissions:block. Permissions set at workflow level can be narrowed or overridden at job level, so inspect the effective permissions for each job. - List every reference to
secrets.*, environment variables, credential files, cloud-login steps, package-manager configuration, and scripts that make network requests. - Check third-party and local actions, including actions called indirectly by a reusable workflow. A compromised dependency can read values available to the calling job.
- Determine whether the runner was GitHub-hosted or self-hosted. A self-hosted runner may contain residual files, credentials, caches, or persistence that must be investigated before reuse.
Review logs without trusting masking
Search logs for token fragments, authorization headers, command output, uploaded artifacts, cache contents, and URLs containing credentials. GitHub’s masking and redaction reduce accidental display, but redaction does not make an exposed credential safe. A secret can still have been copied to an external service, read by a malicious process, or used without appearing in plain text in the log.
Inventory every secret location
Record whether each value came from a repository secret, an environment secret, an organization secret, a variable, a file on the runner, or an external secret manager. Organization secrets can be limited to selected repositories, and environments can have their own values and approval rules; inspect those scopes rather than assuming a repository-level listing is complete.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsInclude the default GITHUB_TOKEN, personal access tokens, GitHub App user or installation credentials, refresh tokens, cloud and package-registry keys, deployment credentials, webhook secrets, and any API key passed to a command or action. Also record where each value is consumed outside GitHub: deployment platforms, registries, cloud accounts, monitoring systems, and other automation.
Classify each credential before rotating it
Rotation depends on the credential owner, lifetime, scope, storage location, and available revocation control. Use the following distinctions to avoid treating every token as if it behaved like a PAT.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
| Credential | Lifetime and scope | What to do after possible exposure |
|---|---|---|
GITHUB_TOKEN |
A GitHub App installation access token created for each job and scoped to the repository containing the workflow. It expires automatically when the job ends or at its effective maximum lifetime. | Cancel an active run when appropriate, investigate use, and correct permissions. It normally does not require manual replacement like a PAT, but any credentials the job accessed through it may require rotation. |
| Classic personal access token | Long-lived and manually revoked. Its permissions can be broad, so its blast radius may exceed the affected repository. | Revoke it through the owning account, create a replacement with only the required access, update all consumers, and remove the old value. |
| Fine-grained personal access token | Configurable resource and permission scope; it can be set for up to one year or with no expiration, and revocation is manual. | Revoke the exposed token, issue a replacement with the smallest repository and permission set, update every consumer, and verify its expiration policy. |
| GitHub App user token | Short-lived, with behavior controlled by the app and authorization flow. | Use the app’s revocation or authorization controls and invalidate any associated refresh capability if the flow provides one. |
| GitHub App installation token | Short-lived and scoped to an installation’s permissions and repositories. | Determine whether it has already expired; still investigate its use and rotate any longer-lived app credentials or refresh tokens that made it available. |
| App refresh token | Longer-lived and manually revoked in the applicable app or authorization system. | Revoke it through that system, issue a replacement, and update the GitHub secret and every external consumer. |
| Third-party API, cloud, registry, or deployment key | Lifetime and permissions are defined by the external provider and may not end with the workflow. | Revoke or disable it at the provider, create a replacement with reduced scope, update all locations, test the dependent automation, and remove the old key. |
GitHub-hosted jobs have a maximum execution time of six hours. Self-hosted jobs can run for up to five days, and the GITHUB_TOKEN on a self-hosted runner can be refreshed for up to 24 hours even though the job’s maximum duration is longer. These limits matter when estimating how long a token may have remained usable; they do not make a PAT or external key expire.
Rotate exposed credentials step by step
1. Capture a rotation worksheet
Create one row for every potentially exposed value. Record the credential type, owner, account or app, permission scope, repositories and environments, first and last possible exposure, storage locations, external consumers, revocation method, replacement status, and evidence reviewed. Do not paste the secret itself into the worksheet or incident channel.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
2. Stop or isolate the source of exposure
Fix the immediate workflow path that exposed the value before rerunning it. Remove a malicious step, disable a compromised branch or workflow, quarantine a self-hosted runner, or block the affected action. If the workflow is still running, cancel it so the job-scoped token reaches the end of its lifecycle.
3. Revoke long-lived credentials at their owner
For a PAT, use the account’s personal-access-token controls. For an app credential or refresh token, use the app or authorization owner. For a cloud, registry, or other service key, use that provider’s credential-management controls. Revocation should happen before issuing the replacement when the old value could still be used; this prevents a race in which both credentials remain active.
If the service supports disabling a key before deletion, preserve the identifier and audit history while preventing new use. Do not assume that deleting a GitHub secret revokes the credential represented by its value; deleting the stored copy and revoking the credential are separate actions.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
4. Generate a replacement with narrower access
Match the replacement to the job’s actual need. Prefer repository-scoped or environment-scoped access, read-only permissions where possible, short expiration, and an owner who can respond to future incidents. If the job only needs repository metadata or source checkout, it may be able to use the default GITHUB_TOKEN instead of a manually managed PAT.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute5. Update every GitHub secret store
In the affected repository, open Settings → Secrets and variables → Actions and replace the relevant repository secret. Then inspect each environment used by the workflow and update its environment secret. At the organization level, review organization Actions secrets and their repository access policy. A replacement in one scope does not update a same-named secret in another scope.
Also update reusable-workflow callers, deployment configuration, self-hosted-runner services, package-manager files, container or infrastructure systems, and any external secret manager. Search by secret name and by consuming workflow rather than assuming identical names identify identical values.
6. Verify the replacement safely
Run the smallest safe test that exercises the dependent operation. Confirm authentication succeeds, the job can perform only its intended action, and the new value is not printed, uploaded, cached, or written into an artifact. Check both success and failure paths: error handling often exposes headers or environment values when the normal path does not.
7. Remove the old value everywhere
After the replacement is confirmed, delete the old secret from GitHub and external stores, remove local credential files and runner caches, and invalidate sessions or leases associated with it where the provider supports that control. Treat old logs, artifacts, caches, and copied configuration as potential exposure locations even after the active credential has been revoked.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Does the default GITHUB_TOKEN need to be revoked?
Usually, there is no separate long-lived GITHUB_TOKEN to rotate. GitHub creates it for each job as a repository-scoped GitHub App installation token and expires it when the job ends or its effective lifetime limit is reached. If a compromised run is still executing, cancel the run and investigate what it did. If the run is complete, the token should follow that automatic lifecycle, but any PAT, app refresh token, cloud key, or other secret the job could read may remain valid and must be handled separately.
Do not infer safety from automatic expiry. During its valid window, the token may have created branches, modified files, opened pull requests, changed issues, accessed packages, or used permissions granted by the workflow. Review those actions and reduce the workflow’s permissions before enabling it again.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Investigate whether the credentials were used
Review GitHub audit activity
Search audit logs for actions associated with the affected account, app, repository, token owner, and exposure window. Look for repository and branch changes, workflow-file edits, secret or variable changes, authentication events, pull requests, releases, package access, and permission changes. Match timestamps to the compromised run and to any unusual network or deployment activity.
Audit-log fields, retention, and search capability vary by plan, role, and organization configuration. Record what was searched and what was unavailable so that an absence of evidence is not mistaken for proof that no use occurred.
Use security tooling and code search
Check secret-scanning alerts, the security overview, and code search for exposed values or token fragments in branches, commits, issues, pull requests, artifacts, and generated files. Search historical revisions and deleted branches where your retention and permissions allow it. A value can be exposed outside the current default branch.
Check for persistence
- Compare workflow files and action references with a known-good revision.
- Inspect new or altered branches, tags, pull requests, releases, repository variables, environments, and organization settings.
- Review self-hosted runners for new users, services, scheduled tasks, startup scripts, modified tool caches, and unexpected files.
- Check deployments, package publications, cloud activity, and third-party service logs for actions that match the token’s permissions.
- Preserve suspicious artifacts and timestamps before cleaning them up, following your incident-response and legal requirements.
Investigation-tool availability depends on your GitHub plan, permissions, and what logging was enabled before the incident. If a decisive log is unavailable, keep the credential classified as compromised and use the replacement and containment steps rather than treating the gap as reassurance.
Harden the workflow before restoring it
Set least-privilege permissions
Declare permissions explicitly at workflow or job level and grant only what each job needs. A read-only build might begin like this:
permissions:
contents: read
jobs:
build:
permissions:
contents: readAdd a write permission only to the specific job that requires it, and document why. A broad write-capable token turns a compromised dependency or script into a repository-modification incident.
Prefer the default token where it is sufficient
Use GITHUB_TOKEN for repository operations that fit its repository scope and granted permissions. Use a GitHub App token or PAT only when the job genuinely needs access beyond that scope. Every additional credential creates another lifecycle, owner, revocation path, and failure mode.
Pin actions and control what may run
Pin third-party actions to full commit SHAs rather than mutable tags or branches, and review the pinned commit before allowing it. Restrict the actions permitted by repository or organization policy. Recheck pins when intentionally upgrading; do not silently replace a SHA with a floating version during incident cleanup.
Reduce secret exposure inside jobs
- Pass a secret only to the step that needs it, rather than exporting it globally.
- Do not place credentials in command-line arguments, generated files, artifacts, caches, pull-request comments, or debug output.
- Keep privileged deployment jobs behind appropriate branch, environment, and approval controls.
- Review who can modify workflow files, reusable workflows, actions, and self-hosted runners.
- Separate build jobs that process untrusted pull requests from deployment jobs that can access production credentials.
Reassess self-hosted runners
A self-hosted runner that executed attacker-controlled code may no longer be trustworthy. Remove it from service, preserve evidence, rebuild from a known-good image, rotate any credentials present on the host, and review neighboring systems before returning it to the runner pool. Merely deleting a workflow run does not clean a runner.
Common mistakes and how to avoid them
| Mistake | Why it fails | Better response |
|---|---|---|
| Only deleting the GitHub secret | The underlying PAT or external key may still be valid, and copies may exist in other systems. | Revoke the credential at its owner, issue a replacement, and update every consumer and secret scope. |
| Assuming a masked log means the token is safe | Masking changes display, not the credential’s validity or whether a process copied it. | Treat possible exposure as compromise and rotate promptly. |
| Rotating one environment but not others | Production, staging, and review environments can contain separate values under similar names. | Inventory repository, environment, and organization scopes individually. |
| Replacing a broad PAT with another broad PAT | The incident remains easy to repeat and the blast radius is unchanged. | Prefer GITHUB_TOKEN, a narrowly scoped app token, or a fine-grained PAT with an expiration. |
| Disabling all Actions without an exit plan | It may stop the attack but create avoidable outages and does not revoke credentials. | Use targeted containment where evidence permits; document when and how to restore automation. |
| Restoring the workflow before fixing its dependency | The same malicious action, script, or permission path can expose the replacement. | Remove the root cause, pin dependencies, narrow permissions, and test in an isolated path first. |
| Ignoring audit gaps | Missing logs do not establish that a token was unused. | Record the limitation and maintain the compromised classification when exposure remains possible. |
Completion checklist
- Active runs and affected runners were assessed and contained in proportion to the evidence.
- The workflow, called actions, scripts, logs, artifacts, environments, and secret scopes were reviewed.
- Every potentially exposed credential has an owner, scope, lifetime, and revocation status recorded.
- PATs, app refresh credentials, and third-party keys were revoked and replaced where exposure was possible.
- New values were updated in repository, environment, and organization secrets plus every connected external system.
- The old values were removed from stores, files, caches, artifacts, and runner hosts where applicable.
- Audit logs, secret-scanning alerts, security overview, code search, and external service logs were checked within their available retention.
- Unauthorized branches, workflow changes, deployments, package releases, and runner persistence were ruled out or remediated.
- Workflow and job permissions are explicit and minimal, third-party actions are pinned to full commit SHAs, and allowed actions are controlled.
- Normal operation was restored only after the exposure path was fixed and a controlled verification succeeded.
When to involve your security or enterprise team
Escalate when the token could access production, multiple repositories, organization or enterprise administration, private packages, customer data, signing systems, or cloud infrastructure; when a self-hosted runner may be persistent; or when audit evidence suggests unauthorized use. Enterprise-wide controls vary by configuration and role, so administrators should use targeted actions when the account or credential type is known and reserve broad emergency controls for incidents that justify their impact.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →The final decision is not whether a token appeared in a log. It is whether the workflow could have exposed a credential and whether that credential could still be used. If both answers might be yes, revoke or replace it, update every consumer, investigate its activity, and return to service only after the workflow’s permissions and dependencies have been reduced.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
