4 ms·
Try here: https://github.com/settings/security-log https://github.com/settings/security-log
by nomilk 5y ago
Try here: https://github.com/settings/security-log https://github.com/settings/security-log
- captn3m0 5y agoDon’t think these logs mention the oauth application being used to access at all.
- samcheng 5y agoI used here: https://github.com/organizations/<ORG_NAME>/settings/audit-log https://github.com/organizations/<ORG_NAME>/settings/audit-l... ... but the real question is what would malicious activity look like, exactly?
- yeskia 5y agoI see a heap of "downloaded a zip of repository" but I suspect that's Heroku CI or other CI tool running.
- domh 5y agoYeah I see lots of the same. They seem to correspond with Heroku deploys? Anyone know if that happens when a valid heroku deploy occurs? Do they download a zip? I've reached out to Heroku support to ask.
- andrelaszlo 5y agoPlease let us know if you get any info from them! :)
- heartbreak 5y agoNormal Heroku usage doesn’t download a zip because it uses git directly, but I’ve seen plenty of CI tools download zips.
- domh 5y agoI thought as much. Maybe it is CircleCI then.
- all-the-lights 5y agoIncluding Heroku CI? We don't use an external CI tool (or really any other integrations except GH), but I do see these download logs.
- heartbreak 5y agoFor what it's worth, elsewhere in this comment section someone posted that Github Support says the zip downloads weren't related to this incident. Reading between the lines, the compromised repos were probably accessed using normal git clone actions.
- all-the-lights 5y agoThat was me who posted that :) seems unrelated, but still hoping to get that figured out anyway.
- all-the-lights 5y agoSame. Most belong to 1 member of our team, but a few belong to others on the team. They started happening about 6 months ago (unless logs only go back 6 mo). Would really like to figure out what these are. I asked GH, they said it’s not involved with this breach, and haven’t yet answered my next question (who/what is it?)
- janejeon 5y agoI believe OP was asking what to look out for within the security log, not how to look at the security log.