Free tool: runs in your browser
GitHub Actions secret exposure response checklistwhen you suspect a malicious commit or pull request in a repository that uses GitHub Actions
TimeBinder adds a layer of protection against AI and human fraud and disputes. Check the known signs, what your workflows can reach and whether you saved the evidence before you change anything.
Nothing you tick is sent anywhere. This page cannot scan a repository or tell you whether a secret was stolen. It is not incident-response advice. The reports it mentions are the researchers’ statements, and the numbers in them change.
Check the signs, what the workflows can reach and the records you keep
Tick what is true about your repositories and workflows. You get a shareable result and clear next steps. Nothing you tick is sent to TimeBinder.
Your choices stay on this page. Nothing you tick is sent anywhere or tied to your name.
Tick everything that is true about the repositories and workflows you are checking
This looks at known signs in your repositories, what a workflow could reach, and whether you saved the evidence before changing anything. It is not a scanner and cannot tell you whether a secret was stolen.
What to do now
What should I do if a malicious commit may have reached my GitHub Actions workflows? The short answer
Save the evidence first. Export the pull request list, the commit history, the organisation audit log and the workflow run list, and note any gap in run numbers. OX Security’s report on the wfx-loot campaign says the attackers revert the malicious commit and delete the workflow run and its logs, so the most reliable trace left behind is a missing run number. If a malicious commit reached a repository with Actions enabled, OX says to treat every secret, variable and cloud role that workflow could reach as compromised, even if no run is visible, and to look for access that was already set up, because rotating secrets does not remove it.
This checklist cannot tell you whether a secret was stolen. A TimeBind of a file you already hold, such as an exported commit list or audit log, can show that exact file existed no later than a recorded time and still matches. It does not show that nothing was stolen.
Why this came up in November 2026
On 12 November 2026 OX Security described a campaign it calls wfx-loot. It says 4,837 hijacked GitHub accounts opened more than 66,000 probe pull requests titled “docs: dependency audit notes” from a branch named wfx-docs, that malicious commits reached more than 8,000 public repositories, and that secrets were sent out from at least 1,806 repositories. It also says the commits were authored as real users of each repository, with no signature, which points to stolen access tokens rather than a flaw in GitHub itself. The numbers were still changing when it published.
It follows other recent reports about developer machines and AI coding tools. Socket analysed a malicious Ruby gem, strutil-core 1.0.1, that it says steals credentials on install, and Gridinsoft summarised a worm that targets setup files for AI coding agents. This checklist covers only the GitHub Actions side.
Measured attention is visible. Checked on 13 November 2026, about 7:10 AM Australia/Brisbane. Public posts on X about the campaign had drawn 3,641 and 2,177 impressions within a day of the report, and a post on Socket’s guide to hardening GitHub Actions had 2,604. Google autocomplete for “github account hijacked what to do” returned “github hacked what to do”, “github security settings” and “github recovery code”. Autocomplete shows what people type. It is not search volume.
For the workflow files themselves, see the GitHub Actions workflow lockfile checklist.
Sources: OX Security, wfx-loot, Socket, strutil-core and Gridinsoft, Miasma.
What this checklist does and does not do
The honest job of this page is to put the checks in a sensible order, not to investigate any repository. See also the npm package compromise response checklist and the glossary entries for existed no later than and fingerprint.
| Part | What it does | What it does not do |
|---|---|---|
| Signs in your repositories | Reminds you to look for the pull request title, branch name and commit titles researchers published, and for gaps in workflow run numbers. | Tell you whether a commit is malicious. |
| What the workflows can reach | Reminds you to list the secrets, cloud roles and tokens each workflow can read, and which bots can push without branch protection. | Limit what a workflow can do. |
| Your records | Reminds you to save lists and logs with dates before you change or delete anything. | Show that nothing was stolen. |
| A TimeBind of a file you already hold | Records that an exact file existed no later than a recorded time and still matches, using a SHA-256 fingerprint made in your browser. The file stays on your device. | Show that no secret was stolen or that a repository is clean. |
If the lists and logs you export are something you may need to show later
When you export the evidence:
- Export the pull request list, the commit history, the audit log and the workflow run list before you change or delete anything.
- Make a TimeBind of each exact file you already hold. The fingerprint is made in your browser and the file stays on your device. You can later download a Proof of Time Certificate.
- Store the exports, your notes and the certificate together, with the date of each export.
A TimeBind shows the exact file existed no later than the recorded time and still matches. It cannot show that nothing was stolen.
First Pooled TimeBind free, no card, then from US$5. An ASAP TimeBind is US$15.
What a TimeBind shows, and what it does not. It shows that an exact file existed no later than a recorded time and that a copy shown later still matches its fingerprint. It does not show who made the file, who owns it, that its contents are true, or whether AI was used to make or edit it. This is general information, not legal advice.
GitHub Actions secret exposure response checklist: FAQ
What is wfx-loot?
It is the name OX Security gave to a campaign that used hijacked GitHub accounts to push a secret stealer into repositories that use GitHub Actions. The numbers in its report were still changing when it was published.
Does deleting a workflow run remove the risk?
No. If a malicious workflow ran, whatever it could reach may already have been sent out. Treat the secrets that workflow could read as exposed and rotate them from a clean machine.
Why save the evidence before I rotate secrets?
Reverted commits and deleted runs are easy to lose, and you may need the lists later for your own team, your customers or your insurer. Save them first, with dates.
Does a dated record show that no secret was stolen?
No. A TimeBind of a file you already hold, such as an exported audit log, can show that exact file existed no later than a recorded time and still matches. It does not show that nothing was stolen.
Is this security advice?
No. It is a list of checks. Follow your own security team’s guidance, GitHub’s documentation and the researchers’ current reports.
Is anything I tick sent to TimeBinder?
No. The checklist runs in your browser. Your ticks stay on the page.
Related guides and tools
- GitHub Actions workflow lockfile checklistWorkflow file checks
- npm package compromise response checklistAfter a bad package
- AI coding assistant settings file secrets checklistSecrets next to settings files
- AI agent instruction file review checklistWhat an agent is told
- GlossaryPlain definitions of fingerprint, SHA-256 and existed no later than
- All free toolsPrivate, in-browser tools
Date the exact files you already hold
Add a layer of protection against AI and human fraud and disputes: a dated, checkable record of the lists and logs you exported.
- Open the app and sign in with email or Google.
- Add your files. They stay on your computer.
- Seal them and download your Proof of Time certificates.
First Pooled TimeBind free, no card, then from US$5. See pricing.