Bulk GitHub Repository Cloning from Single Account in Short Window

Arnold Chan@slaz

•updated Sep 19, 2026•0•0•1

Detects an anomalous burst of git clone, fetch, or download events performed by a single GitHub user account against a large number of private repositories within a short timeframe (15-minute window). This pattern often indicates unauthorized bulk collection or exfiltration of sensitive source code by an actor using a valid account.