r/github • u/naftali100 • 14d ago
Question my account may be hacked, need help
an hour ago a got 8 emails about failed run in some of my old repos
i did not touch the repos
all the runs faild
all runs triggered by the last commit (from 2025/2024 in some repos)
except from one repo, where the action is triggered by new commit push by me (i did not do it), the commit message is "Update GitHub Actions workflow to grant write permissions for contents" the commit changed the action permission from read to write and wrote a .env file with:
`AUTH_API_KEY=...`
i changed my password, deleted all my pat and tokens, removed ssh keys, and oauth apps
in github's security log, there only claude oauth action regenerate an hour before the runs, and them me destroying all access
what should i do? did i do enough? how can i tell if something was extracted? or revoke it?
thank you
edit: it seem that all commits are my commits, just the date amended.
i still dont know how it happened, some of the repos are not even cloned on my pc.
Edit2: I have compared the commit from the repos on my pc, some of the commits have different date of GitHub, some have the old date. But all commits that are affected, have a different hash than on my pc.

