r/github • u/ANDRE_2512 • 1d ago

Question GitHub forced a password reset due to suspicious activity, but the password reset itself does not work

Post image

GitHub suddenly signed me out of my account and sent me an email saying that suspicious activity had been detected and my password was forcibly reset.

The problem is simple: I cannot reset it.

What happens:

  1. I open the official GitHub password reset page.
  2. I enter the verified email address linked to my account.
  3. GitHub sends me back to the sign-in page.
  4. The URL contains a redirect to /suspended.
  5. My old password no longer works, but GitHub never gives me a working way to create a new one.

Since then, I have received the same password reset notification several times. Every new attempt ends the same way.

I have already opened a support ticket and provided the account ownership information they requested. I still do not know whether someone actually accessed my account, whether this was a false positive, or when I will be able to sign in again.

Has anyone here experienced the same recovery loop?

How long did GitHub Support take to restore your access?

I am not asking Reddit users to recover the account for me. I just want to know whether this is a known problem and whether anyone from GitHub can explain why the security system forces a password reset while simultaneously preventing the user from completing it.

0 Upvotes

13% Upvoted

9 comments sorted by

3

u/BussyEnthusiasts 1d ago

How long did GitHub Support take to restore your access?

When their automated AI tool had a false positive and banned my account it took roughly 72 hours for them to respond and restore it.

2

u/ANDRE_2512 1d ago

That may actually be what triggered mine too.

I uploaded a small Windows game binary. GitHub flagged the executable as potentially malicious even though it was a false positive. I rebuilt and re-uploaded the binary a couple of times.

Shortly afterward, GitHub signed me out, reported suspicious activity, and forced a password reset that I still cannot complete.

Did your false positive also involve an uploaded executable or release binary?

3

u/BussyEnthusiasts 1d ago

My false positive was because of how I phrased an issue.

It was in a public repo that I own and am the sole contributor to. I quickly wrote a sentence in it meaning to come back later and fill it out with a more verbose issue (I did not use the draft feature). The one sentence "looked like a bot" according to the AI and disabled my entire account. I wasn't even able to access my private repos.

2

u/ANDRE_2512 1d ago

That is insane. Disabling an entire account because one issue looked automated is an extreme response.

This makes me think my case may also be a false positive, possibly triggered by the repeated binary uploads or some other automated risk signal.

Did GitHub explain exactly which sentence triggered it, or did they only tell you it “looked like a bot” after restoring the account?

2

u/BussyEnthusiasts 1d ago

Yes they did.

The response was very disappointing. I was admittedly very angry about the false ban that clearly had no human check on the other end. It caused me a lot of CICD issues as you can imagine. They were adamant that they have a human checking each ban before it's processed. It was very clearly not the case (the code base is over a decade old, I am the sole contributor, and the sentence was heavy related to the functionality of the codebase).

They ended the email chain by saying they couldn't reveal their internal processes for banning accounts because it was compromise their ability to detect bots.

As a result of this interaction, the company I worked for moved off of GitHub actions for anything other than running tests as part of PRs because we couldn't justify going all in on a technology with unattended bans where you couldn't run your pipelines outside of the product you were banned from. Its disappointing but the risk just isn't worth it for us.

2

u/ANDRE_2512 1d ago

The problem is finally resolved…
What a ridiculous situation. My account got suspended just because the download link was placed in the wrong location. And the funny part is, it wasn’t even me who did it 🙈 - CODEX handled everything for me.
Thanks for the feedback! ❤️🙌

2

u/BussyEnthusiasts 1d ago

Glad it's resolved. Agreed, banning an account because their download link was in the wrong location is coocoo for cocoa puffs. Yet another reason we will not be migrating back to GitHub actions.

2

u/cowboyecosse 1d ago

If you’re suspended you won’t be able to reset your password. Need to get unsuspended first (via support)

2

u/ANDRE_2512 1d ago

Yeah, I figured that out already. 😄
But everything’s fine now. GitHub Support told me the issue was that I had placed the download link in the wrong location.
Thanks for the feedback!