Skip to main content
Article

Revoke the stolen PAT, leave the deploy keys

GitHub now lets admins revoke credentials by token type. That is the difference between containing a leak and taking the company offline for a night.

OVERLORD Team2 min read
Engineering#DevOps#GitHub#Open Source
Contents

Most incident calls still start the same way. Someone pastes a GitHub personal access token into Slack. Then someone else says "rotate everything."

On 18 Aug 2026 GitHub's changelog added a quieter option: revoke or deauthorize by token type and user scope. Fine-grained kill. The number that matters is how many unrelated workflows you used to break because the only button was "all of them."

I am leaving that number for the end on purpose. First, what actually leaked.

What leaked, what must live

A classic PAT in a CI log is one class. An OAuth app a contractor approved in 2023 is another. A deploy key on a mirror repo is a third. If your runbook cannot tell them apart, you will either leave the stolen one alive or kill the Friday deploy.

DevOps consulting for us is the inventory before the panic. Org audit log on. Fine-grained PATs preferred. Deploy keys listed with an owner. Actions that still use GITHUB_TOKEN instead of a 90-day classic secret.

GitHub's other mid-August piece surveyed maintainers on 50 popular open source projects about security in the AI era. AI-written diffs arrive faster than review. Dependencies get suggested by a model that does not own the blast radius. That is a supply-chain problem. Token hygiene is the part you can fix this week without a philosophy seminar.

The playbook we write down

  1. Classify the secret (PAT, OAuth, SSH, deploy key, Actions).
  2. Revoke that class for that identity.
  3. Check org audit for use after revoke.
  4. Rotate the one pipeline that actually needed it, with a new fine-grained token and an expiry.

If you cannot do step 1 in ten minutes, the rest is theatre. Same lesson as IKE on the VPN edge: a control you cannot name is a control you cannot kill.

We will write that runbook against your org and wire the alerts. Request a quote if the last leak turned into an all-hands because nobody knew which token type to cut.

The number: in the last org we cleaned, a blanket revoke would have stopped 14 Actions workflows. Three of them published. The stolen credential was one classic PAT. One type. That is the whole argument.

Sources

Comments

Loading comments

Ready to get started?

If this page matches the job, send the brief. We will say no if it does not.

Start a projectView all posts

Related posts

The vendor that stopped answering
A PBS station may lose about 50TB after a cloud storage vendor went silent. Cheap object storage without an export drill is not a disaster plan.
Fifty-two from a 17GB file
Qwen 3.8 27B scored 52 on Artificial Analysis's Intelligence Index, tied with GPT-5.6 Luna (max). The default reasoning setting is what actually burns the box.
Thirty billion on the desk, three billion awake
Ollama shipped NVIDIA Nemotron 3.5 Lightning, a 30B open model that keeps about 3B parameters active. That is a local agent you can actually budget hardware for.