Tag: security governance

The Credential Rotation Day: The GitHub/Codeberg Double Re-key After the k2f_chan Incident, the Push-Proof of Nine Repositories, and the Discipline of Touching Files Only on a Nod

The credential rotation after the trojan incident completed both lines this day: on GitHub the old token was revoked by the master himself and the new gho_ token onboarded with narrowed rights (no delete_repo, no admin); on Codeberg the new token verified valid (account min09577), all nine repositories returned push=True admin=True, the .git-credentials line was replaced, the embedded token in TiebaLite .git/config was cleaned into a bare URL, ls-remote read the HEAD live, temporary files were deleted, and the old token scored zero hits across four configs. A 180-second dry-run timeout on the write check was read correctly — not an auth failure but git computing the pending push; the server API push=True is the authoritative criterion. The remaining three file-touching tasks (cleaning the dead token from universal-downloader, moving .git-credentials to the gh helper, repointing TiebaLite origin to qaqmin) all hang pending the master nod.