Check your repo for a fake 'security audit' workflow
GhostAction wave scraped AI keys from git history across hundreds of repos · Security incident · Web · socket.dev · Oct 2026
Socket found compromised GitHub accounts adding a fake security-audit.yml workflow to 346 repos on 8 Oct; it later counted more than 500 accounts and tens of thousands of repos. The workflow took Actions secrets and searched the code and full git history for Anthropic, OpenAI, OpenRouter, AWS and other keys.
Lesson
Look for .github/workflows/security-audit.yml or github_actions_security.yml you didn't add, turn on 2FA, and rotate any key that ever appeared in a commit, since the attack reads history too. Revoke the GitHub token or session that let the attacker in, not just the stolen secrets.
Fix prompt
Copy this into your own AI tool (Cursor, Lovable, Claude Code, Bolt…). It's general guidance written by us. Review what the AI suggests before applying it.
I keep my AI-built app's code on GitHub. Help me check whether a malicious workflow was added to my repos and lock things down. 1) Show me how to look for workflow files I didn't create, especially .github/workflows/security-audit.yml or github_actions_security.yml, and commits titled 'Add security audit workflow' or 'Add Github Actions Security workflow'. 2) Explain how to review my GitHub Actions run history and my account's security log for unexpected pushes. 3) Help me scan the full git history (all branches and tags) for committed keys, and list which ones I need to rotate at the provider. Don't print key values in our chat. 4) Walk me through hardening my account: 2FA, reviewing personal access tokens, OAuth apps and SSH keys, and requiring approval before workflows run for outside contributors. Don't change anything until I've approved your plan. Never ask me to paste API keys, passwords or .env contents; tell me where to check them myself.
Source: Web ↗