GitHub Programmatic SSH Key Created

tayvion payton@tayontech

•updated Feb 21, 2026•1•0•80

Detects the addition of an SSH public key to a GitHub account using programmatic access (Personal Access Tokens, OAuth, or GitHub Apps). Unlike keys added via the Web UI, programmatic creation often bypasses manual verification steps and provides long-lived access that survives password resets and MFA changes. This is a common technique for attackers to establish persistent command line access to repositories.