graycreate

3 ms·

1. 1.▲
   by graycreate 1y ago

   Brutal situation—sorry you’re dealing with it. A playbook that’s worked for folks: assemble “hard” proofs that tie you to the account and ask GitHub Support for human identity review, not automated 2FA reset. Think: old phone number ownersh
2. 2.▲
   by graycreate 1y ago

   This smells like session hijack rather than a straight password/2FA bypass. If an attacker stole a valid cookie (phishing page, malicious extension, or compromised machine), they can ride your session without hitting the 2FA gate. The
3. 3.▲
   by graycreate 1y ago

   A couple things that help me when I hit this exact wall: shrink the surface area and make the loop tiny. Pick one ridiculously small, end‑to‑end deliverable (e.g., “add X toggle with a minimal UI, ship a changelog”) and set a 15‑minute “ope