The day my GitHub token stopped being mine

Short summary

A supply-chain compromise exfiltrated the author's GitHub token through a malicious dependency or extension, resulting in unauthorized commits and lost client engagement. Forensic investigation exposed preventable security gaps: over-broad token scopes, unsigned commits, and insufficient audit logging. The detailed incident postmortem provides actionable practices—fine-grained PATs, short TTLs, commit signing, and persistent telemetry—for hardening developer environments.

• •GitHub PAT exfiltrated via supply-chain attack, leading to unauthorized commits and client loss
• •Forensic investigation identified critical gaps: overly broad token scopes and missing commit signing
• •Practical hardening steps: adopt fine-grained PATs, short-lived tokens, commit signing, and forensic logging

Generated with AI, which can make mistakes.