Code & history
Malicious commits, rewritten history, branches, tags, releases, binaries, generated files, submodules, and visibility changes.
OPERATIONAL PLAYBOOK · IR-05
Secure repository-compromise response
Preserve the record, stop active execution, find every persistence path, restore from trusted state, and prove remediation before normal development resumes.
Preserve before cleanup
Record investigation decisions and collect evidence before destructive remediation, except when an active path must be stopped immediately.
- Export audit logs, workflow logs, artifacts, deployment records, and security alerts.
- Save suspicious files, commits, diffs, refs, releases, screenshots, and query results.
- Record repository, organization, actor, token, IP, timestamp, branch, and environment.
- Hash exports and track collector, source, time, storage location, and access.
- Preserve deleted-run and configuration-change events where available.
- Maintain hypotheses, indicators, scope decisions, containment actions, and approvals.
Audit every execution and persistence surface
Workflows & delivery
Workflow changes and runs, reusable workflows, action references, environments, artifacts, caches, deployments, and runners.
Dependencies
Manifest and lockfile changes, install scripts, registries, compromised packages, dependency confusion, and unpinned actions.
Credentials
Repository, environment and organization secrets; PATs; SSH and deploy keys; app tokens; cloud, registry, signing, and CI credentials.
Persistence
New webhooks, deploy keys, collaborators, teams, apps, OAuth grants, runners, branch bypasses, ruleset changes, and executables.
Downstream impact
Published packages, releases, deployments, images, provenance, clones, forks, mirrors, and systems reachable by exposed credentials.
Contain and remediate with gates
Stop active harm
Revoke exploited credentials; disable malicious workflows, runners, webhooks, apps, deployments, refs, or packages.
Choose the least destructive action that stops execution. Preserve a copy before deletion whenever safe.
Remove persistence
Restore rules and access, remove unauthorized integrations, rebuild runners, audit dependencies, and reinstall trusted pinned versions.
Search every discovered indicator across all in-scope repositories and organizations.
Rotate exposure
Treat potentially exposed credentials as compromised, including signing, cloud, registry, CI, repository, environment, and organization secrets.
Revoke old material, update every consumer, test replacements, and retain proof without recording secret values.
Validate before reopening
- Compare code, workflows, dependencies, releases, and configuration to a trusted baseline.
- Rebuild artifacts and runners from trusted sources; do not reuse suspect caches.
- Run code scanning and resolve incident-relevant findings.
- Run secret scanning across current content and history; rotate first, then resolve alerts.
- Review dependency and malware advisories; reinstall and pin reviewed dependencies.
- Confirm rulesets, branch protection, least-privilege workflow permissions, environments, and reviews.
- Monitor logs, workflows, deployments, API activity, and alerts through a defined observation window.
- Document root cause, affected consumers, residual risk, recovery approval, and owners.
Recovery gate: resume normal development only when the attack path is closed, credentials are rotated, persistence is absent, trusted builds pass, scans are reviewed, and accountable owners approve residual risk.
Control mapping: GitHub's official security incident response guidance and incident investigation areas. Feature availability depends on plan and pre-incident configuration.
AUTHORSHIP & REVIEW
How to trust and adapt this guide
- Author & accountable editor
- Leandro Rocha
- Version
- 1.0
- Published / reviewed
- 18 August 2026
- Review status
- Maintainer-reviewed; independent peer review is not claimed.
- Editorial process
- Read the sourcing, corrections, and AI-assistance policy ↗
Reference basis
- GitHub security incident response guidance
- NIST SP 800-61 Rev. 3
- SLSA supply-chain integrity concepts
- MITRE ATT&CK software supply-chain techniques
Assumptions
- Repository, organization, workflow, identity, package, and deployment records were retained before the incident.
- Responders can revoke credentials and stop workflows without erasing the investigation record.
Limitations
- GitHub security features and audit events vary by plan, role, enablement, and retention configuration.
- Repository remediation does not by itself prove downstream packages, deployments, clones, mirrors, or consumers are clean.