Learned an expensive lesson this week and I'm still not sure how it happened, so posting in case someone here knows.

What happened. I was working on a side project late on Sunday and committed a config file with an AWS access key in it to my private repo. I told myself it's private, I'll move it to env vars tomorrow. Around 6 hours later I woke up to a billing alert. $1,340. Someone had launched a pile of GPU instances in us-east-2 and ap-southeast-1, which I've never used.

Here's what I don't understand. The repo is private. It's not a fork of anything. It has no collaborators and no GitHub Apps installed except Actions. The key was created the same day, so this wasn't an old leak somewhere else.

The only thing I can think of is my laptop. I installed a "theme pack" VS Code extension that week that I've already uninstalled because it had 200 downloads and no repo. But I have no proof it was that.

Questions for you all. How do attackers find keys in a private repo this fast? Can an extension read files from your workspace and send them out without you noticing? And how do you stop this happening again, besides the obvious "don't commit keys"?

I've already:

- Deactivated the key and deleted the IAM user it belonged to

- Moved every key I have out of files and into Infisical, so the project gets them at startup and there's nothing to commit or for an extension to read

- Added a gitleaks pre-commit hook and a budget action that stops instances instead of just emailing me

- Started auditing my VS Code extensions (40 of them, going slowly)

Hey everyone,

I purchased GitHub Copilot Pro through Google Play using UPI, and my Google Play subscription is showing as Active. However, my GitHub account is still showing Copilot Free, even after 3 days.

When I try to restore the purchase in the GitHub Mobile app, I get the following error:

«Purchase failed

Your purchase was successful but we encountered a problem with our services.

Please try again.»

I've also checked GitHub Billing & Licensing, and it still shows my active subscription as Copilot Free.

This is frustrating because the payment was successful, but I haven't received access to the Pro features.

Has anyone faced this issue recently?

- Did your subscription eventually activate automatically?

- Is this a Google Play ↔ GitHub synchronization issue?

- Should I contact GitHub Support or Google Play Support?

- How long did it take to resolve for you?

Any suggestions or help would be appreciated. Thanks!

Help me out guys, I’ve been programming since a long time but don’t know how to use GitHub.

I tried learning from the official videos on YouTube but can’t understand.

Suggest some resources ( Videos preferably ) to learn Git and GitHub.

Pls don’t shame me and all but it’s a genuine question.

3 weeks ago [Celesto CI](https://celesto.ai) was barely near GitHub actions in performance. Now, it has better performance for 90% cheaper price.

- Optimized caches from 2 mins to 40 seconds
- node compile time from 4 mins avg. to 1 min 19 seconds.

Still a lot to do. Gonna take on Blacksmith performance soon.

I have tried to import my key, but it was rejected, my guess is because it is Kyber1024/(X448).

When will GitHub implement gpg 2.5.21 ?

Ai triage and review bots in actions usually read the issue or pr text straight into the prompt. so anyone who can open an issue gets to write part of that prompt and the job often holds a GITHUB_TOKEN with write on issues and PRs and sometimes cloud creds as well. the promptpwnd writeup showed that exact path ending with secrets posted back into the issue

moving the cloud side to oidc or short lived creds from hush security helps yet the GITHUB_TOKEN with write is still sitting right there

so what does yours run with? permissions: read-all on the job that reads untrusted text and a separate job for anything that writes?

I just got banned from github and havent recieved any emails saying why? I will attempt to send an appeal but does anyone know why? Was it because I was on a vpn?

Hi everyone,

Please help me out or at least point me in the right direction.

Since the whole ordeal started with Microsoft I completely lost ability to do anything with GitHub on ChatGPT in Codex.

It sits there connected and it sees the repository, but all I get is:

"Retried just now. Workspace commands and ZIP download still fail; the status service reports offline / pending. GitHub tools are also unavailable here."

I tried disconnecting and reconnecting GitHub, I tried clearing all browser cache and cookies. Ive tried logging out and in to ChatGPT.

Any help is welcome, as I am at my wits end with this already.

Hi everyone,

I recently reset my Mac and unfortunately lost everything related to my GitHub two-factor authentication, including my authenticator app setup and recovery codes.

I've also checked my Mac for any saved SSH keys or HTTPS credentials, but couldn't find anything useful.

I'm now completely locked out of my GitHub account.

Has anyone experienced something similar and successfully recovered their account?

Is there any alternative way to verify account ownership or recover access through GitHub Support?

I'd really appreciate any advice or suggestions. I don't want to lose my GitHub account and all the repositories and work associated with it.

Thanks in advance!

Basically I am doing this project where I am analyzing the pixels of a ton of PNG screenshots from my computer. I am currently using two computers, which is why I am currently committing them instead of keeping them local, but idk if the size of this would get too big and get flagged by GitHub eventually? Git LFS is something I am considering, although cropping the PNGs is something that has reduced a lot of the storage compared to screenshotting the whole screen

GitHub's public preview now lets organization owners and security managers turn AI Scan for repositories on or off through REST endpoints at the organization and repository levels. The new repository_scan setting can be rolled out with scripts or infrastructure as code, and repositories can opt out when the organization allows it.

The limits matter: enabling the setting does not start a scan, each on-demand scan consumes GitHub Code Security AI credits, enterprise policy can block enablement, and GitHub Enterprise Server is not supported.

This is a rollout control, not a new scan-quality result. For teams using AI Scan, the practical change is that coverage can become part of repository provisioning while scan cost and actual findings stay separate.

Source: https://github.blog/changelog/2026-11-13-manage-ai-scan-for-repositories-using-the-rest-api/

The bottom two are the ones I can't understand - I don't understand what either means ... in isolation, or in the context of the other.

I've been on a team for a cool and large community project for going on 5 years now. Have begged them to communicate with GitHub issues and ideally I would like to use a GitHub project so we can organize our thoughts and all. The project consists of events, event organizing and planning, a website, and an upcoming app. I have used issues for things outside of just the code before and it's worked well for me.

This year they said they "really wanted to start using a project managing platform". I of course said that's what I've been trying to do the whole time. I showed them a sample GitHub project and my lead said they didn't know it could do that.

They ultimately decided to go after Asana, claiming that GitHub is a tech tool that has been expanded into project management, implying that it isn't good enough I guess?

I've tried using Asana to see if I can at least understand the fuss, and to see if I can just get GitHub issues from there.

It seems largely the same to me, from a few minutes of use, and the GitHub integration only does pull requests which feels pretty useless.

Partially here just to vent to someone that maybe understands, but insight would be appreciated too. This is genuinely annoying me so much.

Hey guys

My github account fell victim to a token worm attack today. Fortunately, nothing it committed got deployed and I was able to revoke the token in time.

Investigating it further, it seems to involve a self-propagating GitHub worm that has opened 38,000+ identical `wfx-docs` PRs since November 10.

In case you're interested: [https://github.com/search?q=wfx-audit.md&type=pullrequests](https://github.com/search?q=wfx-audit.md&type=pullrequests)

The attack uses stolen GitHub OAuth/PAT tokens to discover writable repositories, inject hidden shell scripts (`.ci-XXXXXX.sh`), and add `postinstall` hooks to `package.json` to execute them during `npm install`.

In my case, it was sending all the information to this URL: [http://194.150.166.244:8080/exfil](http://194.150.166.244:8080/exfil)

Anyone else looking into this right now?