Most advice about securing GitHub stops at the login screen. In practice, an attacker rarely needs your password once a token sits in a public repository or an old laptop still holds a trusted SSH key. A finished github two factor authentication setup protects the web sign-in, but it is only one layer around a developer account.
This guide looks at the credentials that surround your account: tokens, keys, sessions and recovery paths. The goal is a short, repeatable routine that keeps source code, releases and organization access safe.
A GitHub account is reachable through several credentials at once. Each one has its own risks and its own cleanup process.
Password plus second factor for the website.
SSH keys for Git operations over SSH.
Personal access tokens (PATs) for HTTPS, scripts and automation.
OAuth and GitHub App authorizations granted to third-party tools.
Passkeys and security keys for phishing-resistant sign-in.
A second factor on the web interface does not automatically limit what a leaked token can do. That is why tokens and keys deserve their own review.
Most incidents are mundane rather than sophisticated:
A token is committed to a repository by accident.
A .env file appears in a screenshot or a shared archive.
A CI log prints a secret in plain text.
A retired laptop keeps an unprotected private key.
A browser extension or helper script receives broader access than it needs.
GitHub offers secret scanning and push protection features that can catch many accidental commits. Treat them as a safety net, not a replacement for good habits.
Tokens are powerful because they are convenient. That also makes them the most common weak point.
Fine-grained tokens can be limited to specific repositories and specific permissions, and they can expire automatically. Classic tokens usually carry broader scopes. Whenever a task allows it, choose the narrower option.
Create one token per purpose, such as one for a deploy script and another for a local tool.
Set an expiration that matches the job, often 30 to 90 days.
Store tokens in a secret manager or CI secret store, never in source code.
Remove tokens you no longer use from Settings → Developer settings.
Give read-only access unless the task truly needs write access.
Speed matters more than perfection:
Revoke the token immediately. Deleting it from a repository's history does not make it safe.
Review the account's security log for activity you do not recognize.
Rotate any other secret that was stored next to it.
Replace the token with a narrower one and update the dependent systems.
Only then clean the history if the repository is public or widely shared.
SSH keys are quiet credentials. They work in the background, so they are easy to forget.
Modern key types such as Ed25519 are the usual recommendation. Add a passphrase so a copied private key is not instantly usable, and load it through an SSH agent so you are not typing it constantly. Hardware-backed keys add another barrier because the private key never leaves the device.
Open Settings → SSH and GPG keys and compare the list with the devices you actually use. Name keys by device and year, for example work-laptop-2026, so old entries stand out. Delete any key attached to a machine that has been sold, repaired or replaced.
Commit signing lets others verify that a commit came from you. It does not stop account takeover by itself, but it makes unexpected commits easier to spot and supports stricter repository policies.
Security that cannot be recovered becomes a different kind of risk. A lost phone should be an inconvenience, not a permanent lockout.
A dependable authentication app with an encrypted backup or transfer feature means a replaced phone does not erase your access. Test the restore process before you need it, not after.
GitHub provides a set of 16 one-time recovery codes during 2FA enrollment. Keep them in a password manager or another secure place that does not depend on the same device as your authenticator. If you regenerate the set, the old codes stop working, so replace every stored copy.
Where supported, register a passkey or a security key in addition to your authenticator. Having two independent ways in is the simplest protection against a single point of failure.
iPhone users who want codes available on the device they carry every day can install an authentication app with biometric lock, then confirm that the GitHub entry generates valid codes before retiring any old device.
Personal credentials are only part of the picture. Repository settings decide how much damage a single compromised account can do.
Branch protection rules can require pull requests, status checks and at least one review before code reaches your main branch. Even if an attacker obtains a token, a protected branch forces the change through a visible process instead of letting it slip in quietly.
Restrict release and package publishing to a small group of maintainers.
Use separate accounts or environments for automation, rather than a personal login.
Require approval for deployments that touch production.
Review the security log for new tokens, key additions and permission changes. Turn on notifications for sign-ins from new devices, and enable dependency alerts so vulnerable packages are flagged early. A habit of checking these once a month turns silent changes into visible events.
You do not need a full security project. A short checklist, repeated, is enough.
Confirm that two-factor sign-in works on a second device.
Download or regenerate recovery codes and store them separately.
Delete unused tokens and old SSH keys.
Review authorized OAuth apps and remove anything unfamiliar.
Check that your account email is protected with its own second factor.
Review tokens and keys every quarter.
Use short-lived credentials in automation wherever possible.
Never reuse your GitHub password elsewhere.
Treat every setup QR code and secret key as confidential.
A developer account is a gateway to code, customers and infrastructure. Spending a few minutes each quarter on tokens, keys and recovery paths is far cheaper than responding to a compromised repository.