my account may be hacked, need help

[u/naftali100]

an hour ago a got 8 emails about failed run in some of my old repos

i did not touch the repos

all the runs faild

all runs triggered by the last commit (from 2025/2024 in some repos)

except from one repo, where the action is triggered by new commit push by me (i did not do it), the commit message is "Update GitHub Actions workflow to grant write permissions for contents" the commit changed the action permission from read to write and wrote a .env file with:

`AUTH_API_KEY=...`

i changed my password, deleted all my pat and tokens, removed ssh keys, and oauth apps

in github's security log, there only claude oauth action regenerate an hour before the runs, and them me destroying all access

what should i do? did i do enough? how can i tell if something was extracted? or revoke it?

thank you

edit: it seem that all commits are my commits, just the date amended.

i still dont know how it happened, some of the repos are not even cloned on my pc.

Edit2: I have compared the commit from the repos on my pc, some of the commits have different date of GitHub, some have the old date. But all commits that are affected, have a different hash than on my pc.

[u/Ubiquitous_X]

The most important question is how the heck they got past your 2FA? Secure that one immediately.
If it turns out you dont use 2FA, you cant really use Github for anything important and no harm is done anyways

[u/naftali100 → u/Ubiquitous_X]

Of course I have it on.

[u/Palnubis]

Why don't you ask AI? I'm pretty sure AI could find out, advice you immediately and harden your security where needed.

[u/naftali100 → u/Palnubis]

i did, and it seem that all commits are my commits, just the date amended. (the .env commit too.. old me.. 😅)

idk how it happened, some of the repos are not even cloned on my pc.

[u/TheWeeklyBrowsing]

woah that's a lot of steps to take in an hour, props for moving fast

the claude oauth thing an hour before is sketchy, have you revoked that specific integration? just removing tokens doesn't always kill the oauth grant itself

for the.env file with AUTH_API_KEY, you'll want to check what that key's for and rotate it wherever it's used, not just in github. if it connects to any services (cloud providers, APIs, databases), go check those logs too, might show if someone used it in that hour window

you said the gh security log only shows claude regenerating and then you nuking everything, nothing about that "update permissions" commit being pushed? that's weird

[u/naftali100 → u/TheWeeklyBrowsing]

thanks for the reply

i have removed anything related to claude from the integrations.

the .env auth key, what other service it may belong, do i check everyone that was granted access to my account? is it possible to extract auth key for a service connected to my account via gh action?

security log didn't show anything right before outside the claude regenration, looking back, it looks standard that app regenerate/destory oauth

also, i still dont know what triggered all this runs..