What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Assume a suspected GitHub compromise is real until you have checked the account. Change the password, revoke unfamiliar sessions and authorizations, delete unknown SSH or deploy keys, secure the connected email account, then create replacement credentials and enable strong two-factor authentication. A password change by itself does not remove every way an intruder may retain access.
1. Contain access before investigating
Do the containment work from a device you trust and a network you consider safe. If the computer used to access GitHub may be infected, use another device for password and recovery changes. Record suspicious usernames, timestamps, repository names and alert messages, but do not delay revocation while collecting evidence.
As an Amazon Associate I earn from qualifying purchases.
Change the GitHub password
- Open GitHub and go to your profile picture, Settings, then Password and authentication.
- Change the password to a long, unique value that has never been used elsewhere. A password manager can generate and store it.
- Do not reuse the old password on your email account, source-control services, cloud consoles or CI systems. If the old password was reused, change those accounts as well.
A new password blocks password-based sign-ins, but it does not necessarily invalidate existing browser sessions, personal access tokens, OAuth grants, GitHub App authorizations, SSH keys or deploy keys. Continue through every control below.
Revoke unfamiliar sessions
Go to Settings, Sessions. GitHub documents that you can view and revoke active sessions in your settings. Review the browser, device and location details and revoke anything you do not recognize. When the account is clearly compromised, sign out other sessions rather than leaving a doubtful session active. Keep your current trusted session only long enough to complete the cleanup, then sign in again with the new password.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Remove OAuth and GitHub App access
In Settings, open the pages for Applications or authorized OAuth applications and GitHub Apps. Revoke every unfamiliar authorization, including an application that has a broad repository or organization scope. Review familiar applications too: an attacker may have abused an authorization you originally approved. GitHub states that revoking all authorizations can protect enterprises you can access; treat bulk revocation as an emergency containment choice, not a reversible test.
Revoke personal access tokens
Open Settings, Developer settings, and the personal access token pages. Delete tokens you did not create and any token whose value, creation time, last-use record or scope cannot be explained. If compromise is likely, revoke all tokens and issue replacements later. GitHub warns, “These actions are irreversible.” Revocation can immediately stop command-line tools, deployment jobs, integrations and scripts that depended on those credentials.
Delete unknown SSH and deploy keys
Check Settings, SSH and GPG keys for account-level keys. Remove every public key you cannot identify by owner and purpose. GitHub notes that “An unidentified public key may indicate a possible security concern.” Then inspect each repository’s Settings, Deploy keys page. Deploy keys are attached to individual repositories, so an account-level key review will not find them. Remove unknown keys and disable write access for any key that only needs to read code.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Secure the email account linked to GitHub
GitHub recovery messages, password resets and security notices depend on the email account connected to the profile. Change that email password, enable two-factor authentication there, review active sessions and forwarding rules, remove unfamiliar recovery addresses and phone numbers, and check mailbox filters that could hide GitHub alerts. If an attacker controls the email account, they may be able to undo GitHub changes even after you rotate the GitHub password.
2. Rotate credentials without leaving automation broken
Once old access is revoked, create replacement credentials from the cleaned account. Make an inventory before deploying replacements so you know which systems will fail when old credentials stop working.
| Credential or access path | Containment action | Replacement work to plan | Operational effect |
|---|---|---|---|
| Personal access tokens | Delete unfamiliar tokens; revoke all tokens when the account may be exposed | Create new tokens with the smallest required scopes and update scripts, local credential stores and build systems | Old API and Git operations fail immediately after revocation |
| OAuth authorizations and GitHub Apps | Revoke unfamiliar or risky grants; consider revoking all grants during confirmed compromise | Reauthorize only approved applications and review the permissions they request | Integrations may stop until authorization is repeated |
| SSH keys | Delete unknown account keys | Generate a new key pair on a trusted device, add only the public key, and replace references in clients and automation | Git over SSH fails for systems still using the deleted key |
| Repository deploy keys | Remove unknown keys from each repository | Add a replacement key to the specific repository and grant only the required read or write capability | Deploy or checkout jobs using the deleted key stop |
Stage the replacement safely
- List every place the old token, key or authorization was used: laptops, build runners, hosted CI variables, release systems, containers, scheduled jobs and documentation.
- Revoke the old credential. Do not leave it active merely to avoid an outage; an active unknown credential is an unresolved access path.
- Create a replacement with the narrowest permissions and an expiry or rotation date where GitHub offers one.
- Update secret stores and automation, then run a controlled test deployment or read-only operation.
- Search logs for authentication failures and unexpected successful use. Remove copies of the old secret from files, scripts and shared notes.
Do not paste a token into an issue, commit, chat message or shell command that will be retained in history. If a secret was committed, revoke it first; deleting the file in a later commit does not make the leaked value safe.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
3. Enable phishing-resistant sign-in protection
After containment, configure at least two independent recovery methods. GitHub describes passkeys as phishing-resistant and says they do not require memorization or active management. GitHub also supports security keys for sign-in and recovery.
| Method | Best use | Important trade-off |
|---|---|---|
| Passkey | Primary sign-in on a supported phone, computer or password-manager platform | Recovery depends on retaining access to the device or passkey provider; enroll another method |
| FIDO2/WebAuthn security key | Dedicated hardware second factor and an offline recovery option | Keep a second registered key in a separate safe location so loss of one key does not cause lockout |
| TOTP authenticator | Code-based two-factor authentication when passkeys or keys are unavailable | Protect the authenticator backup and recovery codes; codes can be phished if entered into a fake site |
| SMS, where offered | Fallback for users who cannot use another method | Use it only when stronger methods are impractical and maintain additional recovery options |
Enroll and verify the methods
- Go to Settings, Password and authentication, and the two-factor authentication setup.
- Register a passkey or FIDO2 security key first when your devices support it.
- Add a second, independent method, such as another security key or an authenticator, rather than relying on one phone.
- Generate and download GitHub recovery codes. Store them offline or in a protected password manager; do not leave the only copy in the GitHub account itself.
- Test a new sign-in in a private browser window before removing an older method. Confirm that the passkey or key works and that your recovery codes are readable.
Recovery planning is part of account security, not an afterthought. GitHub warns that Support cannot restore access to an account with two-factor authentication if you lose the 2FA credentials and all account-recovery methods.
4. Audit what the intruder could have changed
Credential cleanup tells you how access happened; an impact review tells you what must be repaired or disclosed. Preserve relevant evidence before deleting records when your organization has an incident-response or legal-retention requirement.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Review the account security log
Open the account’s security log and inspect sign-ins, password changes, new keys, token events, authorization changes and other security-sensitive actions. Compare timestamps with your own activity. An unfamiliar event is a lead, not proof of the attacker’s identity; correlate it with repository, email and CI logs.
Inspect repositories and organization membership
- Review recent commits, branches, tags and releases for unauthorized code, dependency changes, backdoors, secrets or altered workflows.
- Check repository collaborators, outside collaborators, teams and organization owners. Remove accounts or permissions that were added without approval.
- Inspect repository webhooks and workflow configuration. Unknown endpoints can receive source-code or deployment events, while modified workflows can exfiltrate secrets.
- Review deploy keys, machine users and environment secrets in every affected repository.
- Check private repositories, forks and downloaded archives for data exposure. Notify repository or organization owners when shared resources may be affected.
Investigate and repair unauthorized changes
Preserve a copy of suspicious commits and webhook configuration before reverting them. Identify who approved or merged the change, whether a workflow executed, and which credentials or artifacts it could access. Revert malicious commits through your normal review process, rotate any secret exposed to a workflow, and verify the resulting build from a trusted revision. If the repository belongs to an organization, coordinate with its owners before deleting evidence or changing branch protections.
Free tools Windows power users keep installed
One-click scans. No signup required.
5. Handle a suspicious SSH key specifically
An unknown key in Settings, SSH and GPG keys is a direct sign that someone may have prepared persistent Git access. Record its title, fingerprint and creation date, then remove it. Search every repository for deploy keys because those are managed separately. Check local machines and build runners for the matching private key, remove it from those systems, and inspect their logs for use. Generate a new key only on a trusted device and add the public half after the old key has been revoked.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
6. Recover safely if you lost 2FA
Try every recovery method you previously configured: another registered passkey or security key, an authenticator backup, recovery codes, or an approved account-recovery process shown by GitHub. Do not disable security controls on a second account to work around the lockout.
GitHub’s documented recovery verification, when you are eligible for it, can take up to three business days. If all 2FA credentials and recovery methods are gone, GitHub states: “For security reasons, GitHub Support will not be able to restore access to accounts with two-factor authentication enabled if you lose your two-factor authentication credentials or lose access to your account recovery methods.” Plan for the possibility that the account cannot be recovered and protect repositories through their organization owners or other authorized administrators.
7. Respond to account restrictions
GitHub may restrict an account while it investigates suspicious activity. Read the security email carefully and follow the specified verification or remediation steps. Do not create a replacement identity to evade a restriction. If the instructions do not restore access or the restriction remains after you complete them, contact GitHub Support through the official support channel and provide the requested account, repository and timeline details.
Recommended Free Tools
8. Prevent the next compromise
- Use a unique GitHub password and store it in a reputable password manager.
- Keep two independent 2FA or recovery methods registered, with recovery codes stored separately from the primary device.
- Review sessions, tokens, OAuth and GitHub App authorizations, SSH keys, deploy keys and webhooks on a regular schedule.
- Give tokens, deploy keys and applications only the permissions their job requires, and set expiration or rotation dates.
- Keep CI/CD secrets in the platform’s secret store, restrict who can change them, and rotate them after staff changes or suspicious workflow activity.
- Protect the email account linked to GitHub with a separate password and strong 2FA.
- Require review for workflow, branch-protection and collaborator changes, and monitor security-log events.
What to remember
The fastest safe sequence is: change the password; revoke sessions, authorizations and tokens; delete unknown SSH and deploy keys; secure the linked email; rotate credentials in automation; enable a passkey or security key plus another recovery method; then audit commits, collaborators, webhooks and the security log. Bulk revocation is irreversible and may cause outages, but leaving an unknown credential active leaves the account exposed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
