Most incident calls still start the same way. Someone pastes a GitHub personal access token into Slack. Then someone else says "rotate everything."
On 18 Aug 2026 GitHub's changelog added a quieter option: revoke or deauthorize by token type and user scope. Fine-grained kill. The number that matters is how many unrelated workflows you used to break because the only button was "all of them."
I am leaving that number for the end on purpose. First, what actually leaked.
What leaked, what must live
A classic PAT in a CI log is one class. An OAuth app a contractor approved in 2023 is another. A deploy key on a mirror repo is a third. If your runbook cannot tell them apart, you will either leave the stolen one alive or kill the Friday deploy.
DevOps consulting for us is the inventory before the panic. Org audit log on. Fine-grained PATs preferred. Deploy keys listed with an owner. Actions that still use GITHUB_TOKEN instead of a 90-day classic secret.
GitHub's other mid-August piece surveyed maintainers on 50 popular open source projects about security in the AI era. AI-written diffs arrive faster than review. Dependencies get suggested by a model that does not own the blast radius. That is a supply-chain problem. Token hygiene is the part you can fix this week without a philosophy seminar.
The playbook we write down
- Classify the secret (PAT, OAuth, SSH, deploy key, Actions).
- Revoke that class for that identity.
- Check org audit for use after revoke.
- Rotate the one pipeline that actually needed it, with a new fine-grained token and an expiry.
If you cannot do step 1 in ten minutes, the rest is theatre. Same lesson as IKE on the VPN edge: a control you cannot name is a control you cannot kill.
We will write that runbook against your org and wire the alerts. Request a quote if the last leak turned into an all-hands because nobody knew which token type to cut.
The number: in the last org we cleaned, a blanket revoke would have stopped 14 Actions workflows. Three of them published. The stolen credential was one classic PAT. One type. That is the whole argument.
Sources
- Credential revocation and deauthorization by token type — GitHub Changelog, 18 Aug 2026
- What 50 open source projects taught us about security in the AI era — GitHub Blog, 13 Aug 2026